check the token also at the login