token.expiration is now immutable