fix(auth): trust the JWT's own exp, and retry once on a 401

fix(auth): trust the JWT's own exp, and retry once on a 401 #258