Change ValidateToken to return a *Token.