decided to separate the incoming at handling clearly from the sync
match and simplify the handshake processing, and route to the token
fix bug in incoming at validation