be more lenient about token expiration

we were killing tokens that may have been in use. while that logic is
certainly correct, there may be transactions in flight. and, to be
super safe, give a very long reprieve interval of 1 day. this keeps the
token database clean and gives us some runway.
Merge pull request #420 from craigtracey/tokentimeout

be more lenient about token expiration