auto login on expired tokens is now optional