private UserToken doVerifyUserToken(String token) {
        if (token == null) {
            return null;
        }
        try {
            UserToken userToken = dataStore.getUserToken(token);
            if (userToken != null && userToken.created != null && userToken.loggedOut == null) {
                //length of validity in millis
                //TODO make the timout configurable, Cookie Timeout must match
                Long validFor = 12L * 60L * 60L * 1000L; // 12 hours
                if (userToken.created > (System.currentTimeMillis()-validFor)) {
                    return userToken;
                }
            }
        } catch (Exception e) {
            // fall through
        }
        return null;
    }