verifying api_token on each request