fix token verification