add test for create user without token