My suggestion is to set the out-parameter "Error" to "Invalid token" at first. If all checks have been passed successfully, set it to an empty string. This would make the whole code shorter and cleaner due to only having 2 lines where this param is assigned a value.