Allow an expiration date without using a refresh token

In some cases you may want to use an expiration date for access tokens,
but no refresh tokens. This small fix will allow that.

I made this change for a small project with an Client Credentials Flow without refresh tokens. I think it should also fix #34.