actually check token expirations, make the auth whitelist check a little nicer, and play around with the index