use DB value when possible
refactor 'validate-token