check user has token before comparing the token