If I need a database query to validate the token, it's not stateless.