Add expire time for token auth

#222 & #221