fixes hardcoded error message in TokenController, adds test coverage for error case