fixed security on update device with passed token