check token & set session user