Token auth: handle token validity