Expire a bit earlier, e.g. after 29min? That way the risk (small as it is) of an expired token being sent is avoided?