TokenStore store = (TokenStore)ep.getEndpointInfo().getProperty(TokenStore.class.getName());
org.apache.cxf.ws.security.tokenstore.SecurityToken tok = store.getToken(id);
assertNotNull(tok);
STSClient sts = (STSClient)ep.get(SecurityConstants.STS_CLIENT);
List<SecurityToken> validTokens = sts.validateSecurityToken(tok);
assertTrue(validTokens != null && !validTokens.isEmpty());
//mess with the token a bit to force it to fail to validate
Element e = tok.getToken();
Element e2 = DOMUtils.getFirstChildWithName(e, e.getNamespaceURI(), "Conditions");