add token authorization and token verification. token can be used to get back permissions that we got when log in