Let Spring Security handle invalid tokens
move token generation out of user service