Expose VerificationKeyStaleDurationMinutes to web.config

The 20 minute default is too short.