Add expiration to query string authorization

Also repair support for query string authorization, regression from
d74a409.