only prompt for token when required
fix tests
fix tenant signin test