verify and decode token