We should test that including the `Bearer` token gives you responses and omitting it gives you a forbidden response.