Turning in JWT add expire to token and add admin assignment.
Expired user is removed (unless they are an admin) preserving their notes.
Client side UI is not optimal but expired user will need to sign up again
to regain access to their notes.