moved AUTH_LIFETIME handling in its own task (cleaner separation, proper payload...