Expire login tokens periodically.

When a login token expires, all open connections associated with that token will
be closed. It will be up to client code to avoid trying to connect with a login
token that is set to expire soon.
Store login token on livedata session.

Allows us to remove sessions from sessionsByLoginToken when they are destroyed.
Make client aware of token expiration times.

accounts-password will not try to auto-login with (and will clear) a login token
that is going to expire within an hour, to try to avoid abrupt disconnects from
an expiring token. Login handlers return a new tokenExpires field to help the
client do this. Made tokenExpires a separate field on the login handlers' result
object instead of just returning the whole token (token + when fields) in the
result to avoid breaking code that assumes that login handlers return a string
as the token field. The tokenExpires field is optional, so other login handlers
that don't set it aren't broken.
Make token expiration times configurable via Accounts.config.
Add token expiration test and fix bugs so it passes.

Also make all token-expiration-related times configurable via Accounts.config.