tests for auth token jwt