WIP: Add expire time for token auth

#222 & #221
Do we want to leave this for cron? I am cool with either way, I don't think there will be a performance impact.