Add configuration for token expiration

Add the ability to set token expiration by configuring the SECURITY_TOKEN_MAX_AGE value.

I'm having trouble getting the test suite to run locally, so I may need a hand to gets some tests covering this feature.