Tokens should timeout after a period of inactivity