verify user by signed time stamp
generate and export token