validate token before login