refactor from jwt-simple to jsonwebtoken and add 2week expiration

really? you can look at '20160' and immediate know if it's the correct value or not? I don't think that's the case for most other developers (including myself).