Expired auth token should be in the past