Adding some session management. Bit of a stop-gap, should probably be migrated to its own lib to keep this relatively simple & single-use.

- By default, tokens retrieved using the the oauth callback handler are base64 encoded JSON of the response from the provider.
- If a path to a certificate (or any file, really) is provided, that will be used to encrypt the token format before passing it back to the caller. This allows a rudimentary 'validation' capability: if the token is parseable, we can consider it vaid.
- A TTL can be specified. If provided, this will attach an "expires" timestamp to the JSON. The token won't be considered valid past this point.
- Unit tests & examples for all of the above.
Fix an expires/ttl bug, add unit tests