docs: function validateToken(req, reply) {
          var authorization = req.headers.authorization;
          if (!authorization) {
              return reply.continue();
          }
  
          // this is hack fix so that localStorage and cookies can either have Bearer or not
          // if in local storate, it is serialized, so need to replace %20 with space
          // need to fix this in the future at the source (i.e. on the client side)
          authorization = authorization.replace('Bearer%20', 'Bearer ');
          if (!authorization.match(/^Bearer /)) {
              authorization = 'Bearer ' + authorization;
          }
  
          var parts = authorization.split(/\s+/);
  
          if (parts.length !== 2) {
              log.debug('Authorization header invalid: ' + authorization);
              return reply.continue();
          }
  
          if (parts[0].toLowerCase() !== 'bearer') {
              log.debug('Authorization no bearer');
              return reply.continue();
          }
  
          if (parts[1].split('.').length !== 3) {
              log.debug('Authorization bearer value invalid');
              return reply.continue();
          }
  
          var token = parts[1];
          return jwt.verify(token, privateKey)
              .then(function (decodedToken) {
                  return getUserForToken(decodedToken);
              })
              .then(function (user) {
                  req.user = user;
                  return reply.continue();
              })
              // if error continue on as anonymous
              .catch(function () {
                  //log.debug('Problem verifying token: ' + token);
                  return reply.continue();
              });
      }