api auth test: use rack-test instead of capybara