extracted token validation logic, though not satisfactorily