Yeah, the auth_plugin object has an auth_token property that is fetched from keystone.  I'm still not sure how to deal with expired tokens.