Validate session token