public static function validate_login_token($token = false) {
        global $CFG;

        if (!empty($CFG->alternateloginurl) || !empty($CFG->disablelogintoken)) {
            // An external login page cannot generate the login token we need to protect CSRF on
            // login requests.
            // Other custom login workflows may skip this check by setting disablelogintoken in config.
            return true;
        }
        if ($token === false) {
            // authenticate_user_login is a core function was extended to validate tokens.
            // For existing uses other than the login form it does not
            // validate that a token was generated.
            // Some uses that do not validate the token are login/token.php,
            // or an auth plugin like auth/ldap/auth.php.
            return true;
        }

        $currenttoken = self::get_login_token();

        // We need to clean the login token so the old one is not valid again.
        self::create_login_token();

        if ($currenttoken !== $token) {
            // Fail the login.
            return false;
        }
        return true;
    }