security token checing works