async token validation