write tests for the bearer token protected endpoint