so it can be used for both new and legacy svcacct tokens. Also move the legacy validator into legacy.go.