uses utcnow() instead of now() when testing for credential validity