Right now, validateAuthToken just validates the signature and checks the expirations date. This is extremely fast because it doesn't require a database lookup.

The problem is that it's vulnerable to long expirations dates. If the expiration date on the auth token is days or months in the future (which it would be, if a user remembers the password) then we can't invalidate tokens (e.g., when a user changes their password).

Instead, we should do the following:

1. After validating, we check a cache for the given token. If we've verified the token within some period of time (say, 1 hour) then we succeed.
2. Otherwise, we read the user info and make sure the credentials match. If they do, then we add the token to the cache (with a datetime) and return success.
3. If they don't match (e.g., because the user changed their password or explicitly signed out) then we fail.