Default users cannot access the API even with a valid token, improved tests to cover this