I've added tests for:
 * invalid expires
 * invalid signature
 * invalid userId
All of them start from a valid and verified token and change or take something away from it.

Expiring signatures are verified in oae-util/tests/test-signature.
The reason I mentioned is because the duration a token is valid is hardcoded (2 mins).
This should probably move to the config, I suppose this should move to the global admin config as well?