guard for no config.providers case

e.g. avoid error when config.development.json doesn’t include any
provider configs
change timestamps (exp/at) to be seconds as per http://openid.net/specs/openid-connect-core-1_0.html

Also added some devDependencies needed to get “npm test” working, and
fixed all 3 broken test cases