validate anonymous form token