RERA, approvals, the builder’s track record, possession timelines and paperwork — what to verify before you pay a token.