add separate test for when the oauth token is null for 2-legged requests