authentication token checking, more modular