@hansw the validation would be handled no different than in general, that is, every time you make any sort of a request from the server you send your token along with it, the server will validate on every connection where validation is needed (as in the requested content isnt public).