this test is not right, the query parameter is `token`, not `key`