I'm wondering if we want the expiration to be handled by the lib itself or by the server using it.

That would be a valid addition to tell: "duration=<duration>" and let the `.decode` blow up if the token is expired. What do you think?