review items: mention freshness of test credentials, realistic instantiation of ApplePayToken objects in test, style polish