@_helpers.positional(<NUM_LIT:3>)<EOL>def validate_token(key, token, user_id, action_id="<STR_LIT>", current_time=None):
if not token:<EOL><INDENT>return False<EOL><DEDENT>try:<EOL><INDENT>decoded = base64.urlsafe_b64decode(token)<EOL>token_time = int(decoded.split(DELIMITER)[-<NUM_LIT:1>])<EOL><DEDENT>except (TypeError, ValueError, binascii.Error):<EOL><INDENT>return False<EOL><DEDENT>if current_time is None:<EOL><INDENT>current_time = time.time()<EOL><DEDENT>if current_time - token_time > DEFAULT_TIMEOUT_SECS:<EOL><INDENT>return False<EOL><DEDENT>expected_token = generate_token(key, user_id, action_id=action_id,<EOL>when=token_time)<EOL>if len(token) != len(expected_token):<EOL><INDENT>return False<EOL><DEDENT>different = <NUM_LIT:0><EOL>for x, y in zip(bytearray(token), bytearray(expected_token)):<EOL><INDENT>different |= x ^ y<EOL><DEDENT>return not different<EOL>
Validates that the given token authorizes the user for the action.

    Tokens are invalid if the time of issue is too old or if the token
    does not match what generateToken outputs (i.e. the token was forged).

    Args:
        key: secret key to use.
        token: a string of the token generated by generateToken.
        user_id: the user ID of the authenticated user.
        action_id: a string identifier of the action they requested
                   authorization for.

    Returns:
        A boolean - True if the user is authorized for the action, False
        otherwise.