api server tests for access token handling