Added quick spec for token validation; more needed.