   it 'should send HTTP 400 if api token is not set', (done) ->
 
     ssoTokenLoginRequestParams = generateSsoTokenLoginRequestParams
-      body : { token : '' }
+      qs : { token : '' }
 
-    request.post ssoTokenLoginRequestParams, (err, res, body) ->
+    request.get ssoTokenLoginRequestParams, (err, res, body) ->
       expect(err).to.not.exist
       expect(res.statusCode).to.be.equal 400
-      expect(body).to.be.equal 'invalid request'
+      expect(body).to.be.equal 'token is required'
       done()
 
 
   it 'should send HTTP 400 if there is no username in jwt token', (done) ->
 
     ssoTokenLoginRequestParams = generateSsoTokenLoginRequestParams
-      body : { token : JUser.createJWT { group : 'someGroup' } }
+      qs : { token : JUser.createJWT { group : 'someGroup' } }
 
-    request.post ssoTokenLoginRequestParams, (err, res, body) ->
+    request.get ssoTokenLoginRequestParams, (err, res, body) ->
       expect(err).to.not.exist
       expect(res.statusCode).to.be.equal 400
       expect(body).to.be.equal 'no username in token'

    withConvertedUserAndApiToken { createGroup : yes }, ({ group }) ->
      token = JUser.createJWT { username: 'non-existent-user', group : group.slug }
      ssoTokenLoginRequestParams = generateSsoTokenLoginRequestParams
        body : { token }

      request.post ssoTokenLoginRequestParams, (err, res, body) ->
        expect(err).to.not.exist
        expect(res.statusCode).to.be.equal 400
        expect(body).to.be.equal 'invalid username!'

        ->
          # trying to use sso token without being a member of the group
          ssoTokenLoginRequestParams = generateSsoTokenLoginRequestParams
            qs : { token }
            url : { subdomain : group.slug }

          request.get ssoTokenLoginRequestParams, (err, res, body) ->
            expect(err).to.not.exist
            expect(res.statusCode).to.be.equal 400
            expect(body).to.be.equal 'user is not a member of the group'
