fix `valid_token?`
changelog & version bump