move exception throwing to verifyToken() instead of the setters