working auth - bearer accessible from /token, and fake protected resources there too