Expired auth token should be in the past

Hi, 
I found a issue with an expired token that never would be invalidated.

```javascript
var TOKEN_TTL_MINUTES = 60;
// differenceInMinutes will result in a negative value, for example -61
var differenceInMinutes = recievedTimespamp.diff(currentTimespamp, 'minutes'); // -61
if (-61 > TOKEN_TTL_MINUTES) {
    return false; // this will never be reached with an expired token
}
```
[see momentjs, a.diff(b, 'minutes)](http://momentjs.com/docs/#/displaying/difference/)