use token in ability checks