fixed config loader to add registration access token; added a couple of negative API tests