auth: token jar handling should realloc correctly