The assertion is not what we want, nor is the argument that is passed
to the `withToken` callback (which is the payload). We want the encoded
token string, which will be inside the Auth plugin.