validate token to avoid confused deputy