functionality in controller, invalid token