require_token now checks for token and login