Consider expiry before vending Keystone auth token

This prevents a situation where the LoadingCache vends expired
authentication tokens to the temporary URL signer.  Other code paths
use the RetryOnRenew handler.