moved requests into callback of token-verify function