Verify 32 character access token from Lock in my API?