implement token decoding and validation

Also address some hlint complaints.