Golang is relatively easy to unit test if the code is architected to enable it (with di-like patterns) and from experience, that will catch things that integration tests can easily miss. I would rather see both sets of tests for something dealing with security.
It's definitely lacking on the unit-testing side and we should do more there, but we think integration tests are the more important of the two in this scenario, because the most fragile bits are the interactions between client-client and client-server. It's a lot harder to self-contain those tests without deploying the platform and clients on various infrastructures.
i'd argue that is exactly what you want to unit test. any breakage of client->unit test client or server->unit test server, should be a big no no. otherwise you easily risk backwards compatible issues.
