expire token according to config setting auth:token_expires_after