we will need to invalidate these keys when we do role assignment, otherwise 1hr is too long