add a test for domain token authentication