check for expired tokens and aggressively delete them #416