fix for missing return header on token expiration