added test coverage for token authentication