token construction and domain validation