[Stuart and Sam] Testing around ApiSessionToken.
[Stuart and Sam] Pull out some hardcoded URLs into config values.