caller                                   /api/me  /api/reports  /api/reports/export  /api/admin/users
no token                                     401           401                  401               401
garbage token                                401           401                  401               401
alice, client with audience mapper           200           200                  403               403
bob,   client with audience mapper           200           200                  200               200
alice, client WITHOUT audience mapper        401           401                  401               401
bob,   client WITHOUT audience mapper        200           200                  200               200
alice, token issued via 127.0.0.1            401           401                  401               401