Is a NullPayload the most meaningful assertion possible? Shouldn't you be looking for an exception or a response header saying not authorized?