allow validateSession to pass in a token.