Have your considered adding an expiration time feature to TokenAuthentication?

[mingti]

I think this is a commonly used feature. JWT can easily set expiration times, but regular tokens cannot.