Expiration is now optional. If auth is set to a number, that is the number of seconds the token is valid for.