how to verify a token signature