add test for invalid token