fix: mss_verify wrapper; use received token to get id, count and session_key