remove hard coded IP addresses; dry up things;
validate token spec