tests for client bearer token