I'll note that this happened on a modern mobile phone, the most secure computing platform currently available. Logins simply should not "expire". There's nothing that makes a high-entropy token in secure storage suddenly go bad.
If you're confused enough to also then treat the same device as very trusted, that's just icing on the cake.
Even more: the token flow didn't work and I had to instead get an OTP by email. One of the, ahem, less secure transports. So the entire theater just collapsed.
