check token in redis and cookie