MAY expire bearer tokens, fix #36
add changelog