add indexes for clientId and userId
improve the work flow, auth code and access token will not be regenerated
added expiration flag