Added token expiration handling.

Expiration field from refresh token has been removed because there is nothing
in OAuth2 specification saying that refresh tokens should be a subject to
expiration. (That field has not been respected anyway). “expires_in” field in
responses now always points to access token expiration time.