better verify token