code: public void removeExpiredTokens(CmsUser user, long now) {
  
          List<String> toRemove = Lists.newArrayList();
          for (Map.Entry<String, Object> entry : user.getAdditionalInfo().entrySet()) {
              String key = entry.getKey();
              if (key.startsWith(KEY_PREFIX)) {
                  try {
                      long expiry = Long.parseLong((String)entry.getValue());
                      if (expiry < now) {
                          toRemove.add(key);
                      }
                  } catch (NumberFormatException e) {
                      toRemove.add(key);
                  }
              }
          }
          LOG.info("Removing " + toRemove.size() + " expired tokens for user " + user.getName());
          for (String removeKey : toRemove) {
              user.getAdditionalInfo().remove(removeKey);
          }
      }
docs: Removes  expired tokens from the user's additional infos.<p>
  
  This method does not write the user back to the database.
  
  @param user the user for which to remove the additional infos
  @param now the current time