Update example to always 200 for expire/destroy
Switch to get-metadata rather than valid-token?

When doing a TokenStore that was not in memory it makes sense to not fetch the same data twice (token metadata) so I switched valid-token? for get-metadata.

get-metadata should still perform checks of token validity before returing the metadata