code: func (s *AuthServer) checkTokenTTL(tok services.ProvisionToken) bool {
  	now := s.clock.Now().UTC()
  	if tok.Expiry().Before(now) {
  		err := s.DeleteToken(tok.GetName())
  		if err != nil {
  			if !trace.IsNotFound(err) {
  				log.Warnf("Unable to delete token from backend: %v.", err)
  			}
  		}
  		return false
  	}
  	return true
  }
docs: // checkTokenTTL checks if the token is still valid. If it is not, the token
  // is removed from the backend and returns false. Otherwise returns true.