Test token expiration is handled in controller