Do not show expired auth tokens on authorizations page

also moved the controller method out of authorizations. b/c that is horrible.