handling token (session) timeout errors