server side validation of student_token