diff --git a/src/test/java/net/hostsharing/hsadminng/hs/scenarios/UseCase.java b/src/test/java/net/hostsharing/hsadminng/hs/scenarios/UseCase.java
index 93943e73..fc8000c7 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/scenarios/UseCase.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/scenarios/UseCase.java
@@ -160,7 +160,7 @@ public abstract class UseCase<T extends UseCase<?>> {
                 .GET()
                 .uri(new URI("http://localhost:" + testSuite.port + uriPath))
                 .header("current-subject", ScenarioTest.RUN_AS_USER)
-                .header("Authorization", "test")
+                .header("Authorization", "test") // FIXME: encode current-subject
                 .timeout(seconds(10))
                 .build();
         final var response = client.send(request, BodyHandlers.ofString());
@@ -176,7 +176,7 @@ public abstract class UseCase<T extends UseCase<?>> {
                 .uri(new URI("http://localhost:" + testSuite.port + uriPath))
                 .header("Content-Type", "application/json")
                 .header("current-subject", ScenarioTest.RUN_AS_USER)
-                .header("Authorization", "test")
+                .header("Authorization", "test") // FIXME: encode current-subject
                 .timeout(seconds(10))
                 .build();
         final var response = client.send(request, BodyHandlers.ofString());
@@ -192,7 +192,7 @@ public abstract class UseCase<T extends UseCase<?>> {
                 .uri(new URI("http://localhost:" + testSuite.port + uriPath))
                 .header("Content-Type", "application/json")
                 .header("current-subject", ScenarioTest.RUN_AS_USER)
-                .header("Authorization", "test")
+                .header("Authorization", "test") // FIXME: encode current-subject
                 .timeout(seconds(10))
                 .build();
         final var response = client.send(request, BodyHandlers.ofString());
@@ -207,6 +207,7 @@ public abstract class UseCase<T extends UseCase<?>> {
                 .uri(new URI("http://localhost:" + testSuite.port + uriPath))
                 .header("Content-Type", "application/json")
                 .header("current-subject", ScenarioTest.RUN_AS_USER)
+                .header("Authorization", "test") // FIXME: encode current-subject
                 .timeout(seconds(10))
                 .build();
         final var response = client.send(request, BodyHandlers.ofString());