fixed explicit time check for token validity