Use OAuthAuthorizationServerOptions.SystemClock and favor AuthenticationProperties.ExpiresUtc when present

https://github.com/AspNet-OpenIdConnect-Server/Owin.Security.OpenIdConnect.Server/issues/1