handle expired token. fixes #3