I see a lot of developers creating refresh tokens with some version of ExpiresAt property and stored in the db, but I would like to know if it makes more sense to use Creat