verify access token on create and on resume