Add an "expiration" field to tokens from #signed_token.

This change is mostly to support caching of tokens by clients.  I've tried to keep it backwards compatible, but it definitely deserves a close look before moving it into production.