Token validation in cache

[kbolashev]

Right now the cache doesn't check that the tokens in it are valid. This way you can add a permanent token, then revoke it on the website, but it won't be "revoked" in the client