This is still probably a good test, but `uuid4()` doesn't return a string. Probably just as good to use `'api-key': 'bad key'` or the like.