the token is base64-encoded so decode it