check user token in servlets