testing that /call-url produces logs with a token value for the user