remove duplicates in test
turn out upm_token is a query param instead of header field