add test that ensures tokens change everytime a user logs in