first tests focusing on the behaviour around  hijacking requests