don't attempt to validate known expired tokens. fixes #1