token expiry: apparently working