More Work On Endpoint Tests

- continuing: list endpoints using a non-admin token