make sure we can get token with unauthenticated client