switched to jsonwebtoken for expirations