ADD: token auth for controller test