(fixed) JWT tokens can now set expiration