updated the 'expires' logic to always account for HTTP_X_AUTH_TTL and fixed a bug