fix(oauth): increase the assertion lifetime to avoid clock skew issues

Fixes #1649.

@ckarlof r?
Not sure if it'd be easier to use something like https://www.npmjs.org/package/duration-js

It doesnt look like duration-js supports years, but you could do something like this pseudo-ness:
```js
var CERT_DURATION_MS = new Duration("6h");
var ASSERTION_DURATION_MS = new Duration("52w") * 25; // 25 years
```

It doesn't give the _exact_ same value as your const, but is only off by ~25d &mdash; and what's a few weeks between friends...