fix(auth): always use current time from db for token