Prune expired tokens before each request

fixes #3