pulled out token validation