move expired token removal to Token class