Can DecodeToken throw because of malicious input of 'token'? If yes, we should catch and handle error gracefully.