Token validation now handled before state change