API_TOKEN=fixture-should-be-rejected