Check Node ID and Nonces when verifying token

* TODO check device ID