Implement OAUTH_DELETE_EXPIRED setting

This augment's PR #48 by cleaning things up a bit and by adding docs. The original pull request added support for expired tokens and grants instead of setting expiration.