Expiration should be minimum of configured and incoming from current request