better user info, handles expired tokens