Does it make sense to redirect a user to the login page when a token is not valid?