maybe we should verify the token of the client?