adding test for user with invalid token