add expiry to auth tokens
expiry [wip]