writing tests for token-auth