Issue 788 check verification tokens

@nchapman - this builds on #890 and should be reviewed after that. This PR actually checks the verification tokens.