these should be two different tests (one without token, one with)