Start giving auth app token responsibility
Clients of the auth app don't want to cache the auth tokens themselves.
Push token management into the auth app, or at least into another object the auth app collaborates with instead of forcing clients to keep track of tokens, and the age of access tokens.