token can expire after 7 days