start implementing token expiration logic