simplify and add more safety to 'certify' api

The 'certify' function currently accepts any "iat" and "exp" claims
and requires users to know about the milliseconds quirk.  Change the
API to take the current 'UTCTime' and requested token duration (in
seconds to ensure correct calculation of the claims and relieve the
library users of this burden.