tested and fixed token check on request headers