Token validation for distributed resource servers