token request/response processing