add request validation into token exchange instructions