nesting findone in auth
add expiration
token log
token