factor out token decoding