Validate the returned token too, just to be sure