code: private void processToken(String tokenData) throws JSONException, LoginException {
  
          JSONObject json = new JSONObject(tokenData);
  
          // Validate that the token hasn't expired.
          ZonedDateTime expires = ZonedDateTime.parse(json.getString("tokenExpires"));
          ZonedDateTime now = ZonedDateTime.now(expires.getZone());
          if (expires.isBefore(now)) {
              throw new LoginException("Token has expired");
          }
  
          /*
           * The following check that expiringState is not null can be removed once the expiring state API is made public. Until then,
           * it can be enabled by setting the early access flag "login.module.expiring.state". See the documentation for how to set
           * the early access flag:
           *
           * https://kaazing.com/doc/5.0/admin-reference/p_configure_gateway_opts/index.html#enable-early-access-features
           */
          if (expiringState != null) {
              // Validate that the token hasn't been used already. If not, then store it until it expires in case it is replayed.
              long duration = Duration.between(now, expires).toMillis();
              String nonce = json.getString("nonce");
              if (expiringState.putIfAbsent(nonce, nonce, duration, TimeUnit.MILLISECONDS) != null) {
                  throw new LoginException(String.format("Token nonce has already been used: %s", nonce));
              }
          }
  
          // Token has passed validity checks. Store the username to be used by the commit() method.
          this.username = json.getString("username");
          logger.fine(String.format("Login: Token is valid for user %s", username));
  
      }
docs: Validate the token and extract the username to add to shared state. An exception is thrown if the token is found to be
  invalid
  
  This method expects the token to be in JSON format:
  
  {
  username: "joe",
  nonce: "5171483440790326",
  tokenExpires: "2017-04-20T15:48:49.187Z"
  }