test set token on user creation
api base controller + auth with token