changed behavior of verifyToken to return false instead of throwing an exception when credentials are empty or invalid.