validate if token belong to logged user