Add step 'the response should indicate the request was unauthorized'