We need a test case, which will:
1. encrypt
2. Base64 decode
3. Change one byte in the middle.
4. Base64 encode
5. Decrypt

Decrypt should throw exception before new String(...) in the method pbeCipher.doFinal(bytes).

Otherwise, I can tamper your cache and you will assume that you give valid tokens, but it is not true :). We need to detect if somebody accidently or explicitly changed your token in the cache. Cipher doesn't give this ability, then we need to build-in using HMAC or MAC.