Remove requirement so expiration can be set with or w/o a refreshToken

This should address concerns in Issues #70, #71, and #82:
* `expires_in` is officially optional, but recommended
* `refresh_token` is optional
* API may return `expires_in` without the `refresh_token`