tests for token validation