Customize token flow OAuth expirations with a config lambda

At NationBuilder, we assign a custom expiration to access tokens derived from token-based OAuth. We do this because our authorization code tokens tend to have very high expirations, while our token-based access tokens have very short ones. This pull request solves this problem for us by enabling the user to define an expiration on each app. Since we placed this configuration option inside of a lambda, it could also by dynamically customized to vary in different ways.

-David
Unused block argument - `routes`. If it's necessary, use `_` or `_routes` as an argument name to indicate that it won't be used. Also consider using a proc without arguments instead of a lambda if you want it to accept any arguments but don't care about them.