add token to transfer.php