fix(auth): trust the JWT's own exp, and retry once on a 401 (#171)

fix(auth): trust the JWT's own exp, and retry once on a 401 (#171) #259