Make OAuth2 BearerToken’s expiration time configurable

The current implementation of `BearerToken.expires_in` property is hard-coded to simply return 3600, but sometimes we need to adjust this for various reasons.  For example, we want to shorten this to 1800 for more security.

It should work as the way it had worked before until you touch added new option.  Two kinds of options were added by us:

- All-in-one default implementations of server endpoints now have a new `token_expires_in` option.  It’s 3600 by default.
- The constructor of `BearerToken` now has a new `expires_in` option.  It also is 3600 by default.

Thanks!