token logic done in server but needs to be tested