Use SystemClock, favor ExpiresUtc when present and make SigningCredentials mandatory

https://github.com/AspNet-OpenIdConnect-Server/Owin.Security.OpenIdConnect.Server/issues/1