OAuth2 expirationAt doest not change when invalidated.

If we first get a valid expires_in from the authorization server, and then later an invalid one, the expiresAt remains at the value it first received. This is misleading because it implies to the application that the new token has an expiration time, which is not true.