fix token authentication

The expiry comparison was backwards.  Fixed it and added unit tests for it.
can this reference `duration` as well?