Is that true?  The token may have the time encoded in it.
When the token is presented to the server it responds with a 401.  The client can then use the WWW-Authenticate response to know what to do next.<p>None of this requires state on the server.