Document OATH tokens.
validate does not need nonce
documentation