AES CBC encoding of decomposable OAuth2 tokens
It probably is doing some good, although there's probably

a simple attack, depending on how long your fields are.

You should use a MAC or authenticated encryption, depending on whether or not you

want to keep $\:$ username + start timestamp + end timestamp $\:$ confidential from someone

who gets access to a user's computer while that computer has a token from your site.