Make auth tokens usable once and expire them.