only accept approved tokens