Expose VerificationKeyStaleDurationMinutes to web.config

The 20 minute default is too short.
Missed an edit
Merge pull request #402 from rallman/master

Expose VerificationKeyStaleDurationMinutes to web.config
changed verification key timeout duration from int to time span
rename verification key stale duration to verification key lifetime
7.4
Merge branch 'master' into allow_@_in_username