assume the presence of env var TOKEN_EXPIRATION_TIMEOUT_MILLISECONDS