ACF-27: Token validation in the server side