Api now checks that the token hasn't expired