code: func (a *authenticator) validateToken(token *jwt.Token, url, method string) error {
  	var userName string
  	// Read audience from the token
  	switch v := token.Claims.(type) {
  	case jwt.MapClaims:
  		var ok bool
  		if userName, ok = v["aud"].(string); !ok {
  			return fmt.Errorf("failed to validate token claims audience")
  		}
  	case jwt.StandardClaims:
  		userName = v.Audience
  	default:
  		return fmt.Errorf("failed to validate token claims")
  	}
  	loggedOut, err := a.userDb.IsLoggedOut(userName)
  	if err != nil {
  		return fmt.Errorf("failed to validate token: %v", err)
  	}
  	if loggedOut {
  		// User logged out
  		token.Valid = false
  		return fmt.Errorf("invalid token")
  	}
  	user, err := a.userDb.GetUser(userName)
  	if err != nil {
  		return fmt.Errorf("failed to validate token: %v", err)
  	}
  	// Do not check for permissions if user is admin
  	if userIsAdmin(user) {
  		return nil
  	}
  	perms := a.getPermissionsForURL(url, method)
  	for _, userPerm := range user.Permissions {
  		for _, perm := range perms {
  			if userPerm == perm {
  				return nil
  			}
  		}
  	}
  
  	return fmt.Errorf("not permitted")
  }
docs: // Validates token itself and permissions