check functionality does not verify session anymore, just provided token.

this feature allows checking tokens issued by another domain