BAC-132: check against token value for permission