Validate requests against GOV.UK SSO using tokens