Allow the creation of access token to be overriden

/to @ritch 

This PR allows us to customize the access token creation so that we can calculate the TTL based on the current user/application and other context.
If this requires the user object, maybe it should be `User.prototype.createAccessToken`.