protected function _performTokenValidation(Event $event)
    {
        $request = $event->getSubject()->request;

        if (!empty($request->getParam('allowWithoutToken')) && $request->getParam('allowWithoutToken')) {
            return true;
        }

        $token = '';

        $header = $request->getHeader('Authorization');

        if (!empty($header[0])) {
            $parts = explode(' ', $header[0]);

            if (count($parts) < 2 || empty($parts[0]) || !preg_match('/^Bearer$/i', $parts[0])) {
                throw new InvalidTokenFormatException();
            }

            $token = $parts[1];
        } elseif (!empty($this->request->getQuery('token'))) {
            $token = $this->request->getQuery('token');
        } elseif (!empty($request->getParam('token'))) {
            $token = $request->getParam('token');
        } else {
            throw new MissingTokenException();
        }

        try {
            $payload = JWT::decode($token, Configure::read('ApiRequest.jwtAuth.cypherKey'), [Configure::read('ApiRequest.jwtAuth.tokenAlgorithm')]);
        } catch (\Exception $e) {
            throw new InvalidTokenException();
        }

        if (empty($payload)) {
            throw new InvalidTokenException();
        }

        $controller = $this->_registry->getController();

        $controller->jwtPayload = $payload;

        $controller->jwtToken = $token;

        Configure::write('accessToken', $token);

        return true;
    }