token based authentication, fixes and fixes
simplify logout, disable seems like unnecessary test