processing inbound /token requests