delete token with check credentials