A couple notes about the unit tests:

1. You should verify that a token that otherwise passes validation but contains a forged signature should not grant login (you only seem to have tests for missing parameters)
2. You should verify that a token that contains an expired signature does not grant login
3. In your tests that verify with a missing expires param and userId param, you should use a token that you have sanity checked to be functional before starting to take away parameters. For example, all of the performSignedTokenRequest calls could be failing solely because the the signature is invalid, and the validation (or the performSignedTokenRequest method itself) could be otherwise broken