Move token validation into own method