Token auth: support for lifetime types, fix auth when token is provided