Added link to permissions page
Updated token validation middleware - harmonized with MS middleware (cert pinning, metadata refresh)