@Test
    public void userInfoRejectsAlgNoneToken() {
        JsonWebToken jwt = createDefaultToken();
        String noneRequest = new JWSBuilder().jsonContent(jwt).none();
        UserInfoResponse response = oauth.doUserInfoRequest(noneRequest);

        assertEquals(401, response.getStatusCode());
        assertFalse(response.isSuccess());
        assertEquals(OAuthErrorException.INVALID_TOKEN, response.getError());
    }

    protected JsonWebToken createDefaultToken() {
        JsonWebToken token = new JsonWebToken();
        token.id(SecretGenerator.getInstance().generateSecureID());
        token.issuer("http://127.0.0.1:8500");
        token.audience(oauth.getEndpoints().getIssuer());
        token.iat((long) Time.currentTime());
        token.exp((long) (Time.currentTime() + 300));
        token.subject("attacker");
        return token;
    }