token store needs access to request because validity of token might depend on further information, e.g. the ip address