Token validator only checks token length