Add test for construct_api_url
Avoid outputting security token to logs