install q and make token.verify returns promise