token should be required