reworked server side validation, added expiration check

Ok, changed the logic a little for efficiency. Enforced the token time validation check.

Olivier