verify token, get uid