FWIW, I think 5 seconds is far too small a margin here. Keep in mind that you need the token to stay valid for the length of the next HTTP request, which could very well take at least a minute just on the backend (nevermind the communication time to get there).