README: JWT specs timestamps as seconds-since-epoch, but we use milliseconds

This documents our use of ms. Addresses id-specs#21.

@benadida: this needs updating in id-specs too. Which way do you want to go.. leave our implementation alone, or conform to upstream JWT?