support token invalidation and offline mode