authenticate without token if token is expired