added token validation at /auth/renew