Token expiry

Make sure tokens expire according to config setting auth:token_expires_after