If we do not set a private token during the test, current_user will be
nil because the user is not found, not due to the access check.