Make OAuth2 token lifetimes configurable