bug prevents testing unauthorized user of api