now verifying token