add tests for token endpoint