so these tests will fail to take into consideration a 'forward'. Say someone decides to 'forward' the response as the input to another api. Your test will fail.

What if they redirect. Same failure.

Always keep in mind the http call flow that can be manipulated in the controller.