New: Auth token max age is now a global setting