Make 'protect' actually check granted access tokens
Ensure that access tokens haven't expired in 'protect'