hitbox - handle expired token