add method token_valid? to ensure token had not been revoked by user

<3