allow override the check for future token

You cannot force the clients to be running exactly the same time as the server. I personally had this issue, where the server was not even tolerating a difference in seconds. Moving the future check logic to a protected method so other implementations can apply their own logic to check for future tokens.