more testing of token auth