Added token expiration handling.

Expiration field from refresh token has been removed because there is nothing
in OAuth2 specification saying that refresh tokens should be a subject to
expiration. (That field has not been respected anyway). “expires_in” field in
responses now always points to access token expiration time.
Changed JSON exceptions’ status code.

According to the OAuth2 specification, when issuing access token,
“The authorization server responds with an HTTP 400 (Bad Request)
status code (unless specified otherwise) […]”.