first (untested) go at expired token handling