token validation code, possibly not working