added token validation (default True on sandbox)