updated System.IdentityModel.Tokens.Jwt to 4.0.0-RC2
Handle expired tokens/bad signatures

JwtAuthenticationMessageHandler
* SecurityTokenExpiredException - return 440
* SecurityTokenSignatureKeyNotFoundException - return 401
* Exception - log unhandled exceptions

Sample Client Smoke Tests
* Add test for expired token