probably need a better fix.

currently the ldap UaaUser's modified time is 'now'. So it's always after token issue time.