SECOAUTH-429: be more liberal in deserializing expires_in

Some providers send a String apparently, so it's better to
be defensive when deserializing.