authenticate token every page load