token auth functional using /protected/ endpoint for testing