Add checks for expired and misused tokens.

Add new payload field "action" which has to match HTTP method's intention (GET -> GETONE or GETALL, DELETE -> DELETEONE or DELETEALL).