check for token on requests