fix: verify token on each call to get admin part of token data