token endpoint working