Update ValidateToken signature.  Only value passed outside of token is IpAddress; which controller can get from RequestHeader.
Add a method to pull the IP address from the HttpRequest.  This will likely be refactored  for reuse later.
We only need to send the token in the request.  We aren't trusing any other data from the client.