fix token authentication

The expiry comparison was backwards.  Fixed it and added unit tests for it.