adding token validation support, switching to async function