if token is undefined, user is not logged in