verify that the access token belongs to us