Fix token validation

Invalid token should not pass even for public endpoins.

Change-Id: I2e9e403690c5f98504504ef9ae4bd620f8895f33
Fix-for-Story: #56