5 min - this is to prevent fake positives from having these records around a long time (tokens expire).
Configurable - I am of the opinion that edge cases with little user exposure should not be configurable. For example - configuring retries on 500 - yes, definitely. Configuring the heuristics for re-authentication, I'm not so sure. Thoughts?
HttpRequest vs HttpCommand - yes that is correct. I don't see the reason to use the lower level of abstraction in here though, the code already used the command one.