change verificationToken to token, remove callback parameter