use UTC time for token expiry