expect(fetcher.fetch(isA(HttpRequest.class))).andReturn(appTokenResponse);
expect(appTokenResponse.getResponse()).andReturn(new ByteArrayInputStream("access_token=appToken123".getBytes("UTF-8")));
expect(fetcher.fetch(isA(HttpRequest.class))).andReturn(inspectResponse);
expect(inspectResponse.getResponse()).andReturn(new ByteArrayInputStream("{data: {is_valid: true, user_id: userId123} }".getBytes("UTF-8")));
expect(codec.encodeToken(isA(LoginSecurityToken.class))).andThrow(new SecurityTokenException("Bad Security Token"));
resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Error generating security token.");
expectLastCall();
replay(accessTokenResponse);
replay(appTokenResponse);