only validate facebook token when necessary