move BearerAuth plugin into project
refactor BearerAuth subscriber
add wiggle room to token expiration
tweak tests