Use AccessToken.verify at token verification endpoint