there should be also tests for presence valid and invalid user token