expire sessions by shortest token