don't use token validation by default (more easy for testing
new version