token validation and logging