accept token instead of creditcard