adding token creation/expiration timestamp and audience validation
moving token signature validation into wsfed_callback method