What is the best way to implement sliding window expiry using the same tokens for an API client and an MVC client