code: public String validateToken(String token)
        throws IllegalArgumentException, TokenExpiredException, ProtocolVersionException {
      final Token deserializedToken =
          CrtAuthCodec.deserializeTokenAuthenticated(decode(token), secret);
      if (deserializedToken.isExpired(timeSupplier)) {
        throw new TokenExpiredException();
      }
      if (deserializedToken.getValidTo() - deserializedToken.getValidFrom() > MAX_VALIDITY) {
        throw new TokenExpiredException("Overly long token lifetime.");
      }
      return deserializedToken.getUserName();
    }
docs: Verify that a given token is valid, i.e. that it has been produced by the current authenticator
  and that it hasn't expired.
  
  @param token the token to validate.
  @return the username that this token belongs to.
  @throws IllegalArgumentException If the token appears to have been tampered with.
  @throws TokenExpiredException    If the token has expired.