docs: function validateToken(req, res, sails, params){
    var config = wl.config;
    var authConfig = wl.authConfig;
    if(params.token){
      try{
        // decode the token
        var _token = jwt.decode(params.token, config.jsonWebTokens.secret);
  
        // set the time of the request
        var _reqTime = Date.now();
  
        // If token is expired
        if(_token.exp <= _reqTime){
          return res.forbidden('Your token is expired.');
        }
  
        // If token is early
        if(_reqTime <= _token.nbf){
          return res.forbidden('This token is early.');
        }
  
        // If audience doesn't match
        if(config.jsonWebTokens.audience !== _token.aud){
          return res.forbidden('This token cannot be accepted for this domain.');
        }
  
        // If the subject doesn't match
        if('password reset' !== _token.sub){
          return res.forbidden('This token cannot be used for this request.');
        }
  
        sails.models.auth.findOne(_token.iss).populate('resetToken').exec(function(err, auth){
          if(typeof auth.resetToken === 'undefined' || params.token !== auth.resetToken.token){
            return res.forbidden('This token cannot be used.');
          }
  
          req.session.resetToken = auth.resetToken;
  
          if(authConfig.passwordReset.mail.forwardUrl){
            res.redirect(authConfig.passwordReset.mail.forwardUrl + '?token=' + auth.resetToken.token);
          }else{
            res.json(200);
          }
  
        });
  
      } catch(err){
        return res.serverError(err);
      }
    }else{
      //TODO limit attempts?
      req.session.resetToken = false;
      res.forbidden();
    }
  }