Right, and I totally agree; however, I think this inherently implies the implementation isn't proper yet as it accepts the token when passed as query string and it should not. It also indicates incomplete tests as there is nothing to test using the actual post body against the endpoint.