setup default_ttl to 23 hours and no need to check if iat is nil
properly reset iat! or we ended up with issuing the same auth