cleaned up token validation (or rather, confirmed lack of is per spec)
Merge branch 'validate-signature'