Add more token auth specs

- specs for warden strategy
- checks that both tokens are valid when 2 are created