Is this also used for "unrecognized token"? Many tokens are delete-after-use, so we can't actually distinguish between never-ever-created, created-but-already-used, and created-but-deleted-by-a-cronjob. The only actual "expired" situation that we could reliably report would be if/when we include a timestamp in the token, and I don't think we have too many of those.