remove auth token on invalidation