Improved endpoint logic and added xml response.
Just test the auth-z filter, and only test against 413's in the various stages of authorization.