api: added test for mangling with a signed request when admin is required.