add bad token to simulate 401