At this point the token has not been validated. Your application must validate the token before using it to grant access ...