How to complete the challenge POST /secret/note (403)
Use POST /secret/note with a valid JSON note payload and include an X-AUTH-TOKEN header, but make the token value invalid.
The API can see an auth token was supplied, but it does not match the current challenger, so the response should be 403.