tests for user bearer token validation