Authentication with Google

The whole idea of token-based authentication is that we shouldn't need to keep any state like that, no? At least in example project (https://github.com/sahat/satellizer/blob/master/examples/server/java/src/main/java/com/example/helloworld/auth/AuthUtils.java) the tokens-to-users is not kept. We wouldn't know when to remove tokens from dictionary.