return the correct error for expired or revoked tokens