verify valid token on each request