moved token parsing to auth service

avoid repeating parse