perf: don't call verify token in constructor