Fix typo (fixes gh-242)
Fix validation of JwtAccessTokenConverter

Because of the order of the validation checks, before this change it
was impossible to use the JwtAccessTokenConverter purely for
RSA verification (i.e. public key only).

Also moved token store tests into subpackage to match the classes they
test.

Fixes gh-245
Ensure EXP claim is stored as a Long in JWT token

Fixes gh-237
Don't declare checked exception with @PostConstruct

Fixes gh-244