verify token without db lookup
use equals versus ===