def METHOD_NAME(self, url, username=None, password=None, allow_session_auth=False, headers=None):
    """
    This tests that the given URL fails when accessed via sessions and returns the response
    obtained via using API auth. It's callers' responsibility to test resource specific logic
    using response returned.
    The user authentication is attempted via default self.username creds, other creds can be passed
    via username and password kwargs
    """
    username = username or self.username
    password = password or self.password
    headers = headers or {}
    if not allow_session_auth:
        self.client.login(username=username, password=password)
        response = self.client.get(url, **headers)
        self.assertEqual(response.status_code, 401)
    # api_key auth should succeed, caller can check for expected code
    headers.update(self._get_api_key_auth_headers(headers, username))
    response = self.client.get(url, **headers)
    return response