Make sure the default created user can access the nonpublic api.