Respect expiration field.

Expired tokens should not pass verification.  OpenID Connect Core 1.0
says these should not be processed.
http://openid.net/specs/openid-connect-core-1_0.html#IDToken

Possible enhancement would be to allow the user to specify a leeway
per Spec's suggestion.