fix bug with token invalidation, add test for restricted routes