disblae token checking (from API login)