code: public AccessTokenInfo validate(
              String accessToken, String[] requiredScopes, String requiredSubject, String clientCertificate) throws WebApplicationException
      {
          if (accessToken == null)
          {
              // Return "400 Bad Request".
              throw toException(Status.BAD_REQUEST, CHALLENGE_ON_MISSING_ACCESS_TOKEN);
          }
  
          try
          {
              return process(accessToken, requiredScopes, requiredSubject, clientCertificate);
          }
          catch (WebApplicationException e)
          {
              throw e;
          }
          catch (Throwable t)
          {
              // Unexpected error.
              throw unexpected("Unexpected error in AccessTokenValidator", t);
          }
      }
docs: Validate an access token.
  
  </p>
  When the given access token is not valid, this method throws a
  {@link WebApplicationException}. The response contained in the
  exception complies with the requirements described in <a href=
  "http://tools.ietf.org/html/rfc6750">RFC 6750</a> (The OAuth
  2.0 Authorization Framework: Bearer Token Usage).
  </p>
  
  @param accessToken
  An access token to validate.
  
  @param requiredScopes
  Scopes that must be associated with the access token.
  {@code null} is okay.
  
  @param requiredSubject
  Subject (= user's unique identifier) that must be associated
  with the access token. {@code null} is okay.
  
  @param clientCertificate
  TLS Certificate of the client presented during a call to
  the resource server, used with TLS-bound access tokens.
  Can be {@code null} if no certificate is presented.
  
  @return
  Information about the access token.
  
  @throws WebApplicationException
  The access token is invalid. To be concrete, one or more of
  the following conditions meet.
  <ol>
  <li>The access token does not exist.
  <li>The access token has expired.
  <li>The access token does not cover the required scopes.
  <li>The access token is not associated with the required subject.
  </ol>