should not verify invalid token