fix token authentication

The expiry comparison was backwards.  Fixed it and added unit tests for it.
might be easier to just do `-1*time.Hour` inline