add a LoggedInHandler that verified "user_id" and "token" request params