Address validation tokens - what are they good for anyway?