add token check on user actions