if resp.StatusCode != http.StatusOK {
		// uncomment this for debugging when needed.
		// reqBytes, _ := httputil.DumpRequest(req, false)
		// fmt.Println(string(reqBytes))
		// respBytes, _ := httputil.DumpResponse(resp, true)
		// fmt.Println(string(respBytes))
		return nil, errors.New(resp.Status)
	}

	claims := map[string]any{}
	if err = json.NewDecoder(resp.Body).Decode(&claims); err != nil {

	if resp.StatusCode != http.StatusOK &&
		resp.StatusCode != http.StatusPartialContent &&
		resp.StatusCode != http.StatusNoContent {
		respTrace, err = httputil.DumpResponse(resp, true)
		if err != nil {
			return
		}
	} else {
		respTrace, err = httputil.DumpResponse(resp, false)
		if err != nil {
			return
		}
	}

	// Write response to trace output.

	}

	for k, v := range maliciousHeaders {
		req.Header.Set(k, v[0])
	}

	// execute the request.
	response, err = s.client.Do(req)
	c.Assert(err, nil)

	// out, err = httputil.DumpResponse(response, true)
	// fmt.Println("RESPONSE ===\n", string(out), err)

	// assert the http response status code.
	c.Assert(response.StatusCode, http.StatusBadRequest)
}