check token on any http request