more testing of token expiration