Token auth: set, return and check token validity