Would be nice to document this behavior and say that you need to specify token.id attribute in the request body if you use "fake account".