improve token-related demo and tests
response 400 if data is invalid when POST /tokens
update Documentation