- add route for <int:pk>/online/validate/ to token validate view - implement authenticated GET returning course, user and metadata - enforce auth only for GET via get_permissions - add Swagger docs for the new endpoint No breaking changes.