Make expires_at optional

The issued_at value is on every token, and will be checked on
every event against the issued_before field.  expires_at
is not going to be mutually exclusive with issued_before:
issued_before will be specified and checked for all tokens, including
those revoked by user and expires_at.  issued_before is
mandatory, and expires_at is optional.

Change-Id: I3e8bcc469ccc7476d517a8f4bd6574ba99dba1f2
clarify user & project namespacing

there's nothing "dependent on the owning domain" about user & project
namespacing.

Change-Id: I519ddb2559293f638808a217d2382d19ce4f835a
Closes-Bug: 1297022
Merge "clarify user & project namespacing"
Merge "Make expires_at optional"