add validation. fix token generation (base64 encode signature - was giving default byte array toString which is memory address