auth: force logout when token is expired.