add token expiration check