anchor.diff:      Endpoint = rest_endpoint(Worker),
   
       % when
  -    AuthFail = do_request(get, Endpoint ++ "files", [{<<"X-Auth-Token">>, <<"invalid">>}]),
  -    AuthSuccess1 = do_request(get, Endpoint ++ "files", [{<<"X-Auth-Token">>, ?MACAROON}]),
  -    AuthSuccess2 = do_request(get, Endpoint ++ "files", [{<<"Macaroon">>, ?MACAROON}]),
  +    AuthFail = do_request(get, Endpoint ++ "files", #{<<"X-Auth-Token">> => <<"invalid">>}),
  +    AuthSuccess1 = do_request(get, Endpoint ++ "files", #{<<"X-Auth-Token">> => ?MACAROON}),
  +    AuthSuccess2 = do_request(get, Endpoint ++ "files", #{<<"Macaroon">> => ?MACAROON}),
   
       % then
       ?assertMatch({ok, 401, _, _}, AuthFail),
  
positive.code:     Endpoint = rest_endpoint(Worker),
  
      % when
      AuthFail = do_request(get, Endpoint ++ "files", [{<<"Authorization">>, <<"invalid">>}]),
      AuthSuccess = do_request(get, Endpoint ++ "files", [{<<"Authorization">>, ?BASIC_AUTH_HEADER}]),
  
      % then
      ?assertMatch({ok, 401, _, _}, AuthFail),
  
negative.code: 
      test_utils:mock_expect(Workers, oz_endpoint, provider_request,
          fun
          % @todo for now, in rest we only use the root macaroon
              (#token_auth{macaroon = Macaroon}, URN, Method, Headers, Body, Options) ->
                  {ok, SrlzdMacaroon} = token_utils:serialize62(Macaroon),
                  AuthorizationHeader = {<<"macaroon">>, SrlzdMacaroon},
                  do_request(Method, OzRestApiUrl ++ URN, Headers#{
                      <<"macaroon">> => SrlzdMacaroon,
                      <<"content-type">> => <<"application/json">>
                  }, Body, [SSLOpts | Options]);
              (#basic_auth{credentials = Credentials}, URN, Method, Headers, Body, Options) ->
                  AuthorizationHeader = {<<"Authorization">>, Credentials},
                  do_request(Method, OzRestApiUrl ++ URN, Headers#{
                      <<"Authorization">> => Credentials,
                      <<"content-type">> => <<"application/json">>
                  }, Body, [SSLOpts | Options]);
              (_, URN, Method, Headers, Body, Options) ->
                  do_request(Method, OzRestApiUrl ++ URN, Headers#{
                      <<"content-type">> => <<"application/json">>
                  }, Body, [SSLOpts | Options])
          end
      ).
  
  