Listing nodes instead of listing users.
Adding error message on test submission for when devel is not present.
Authentication headers should not include querystrings.