correctly propagate expiry time from reauth ticket