require Toke authentication before all user actions