Customize token flow OAuth expirations with a config lambda

At NationBuilder, we assign a custom expiration to access tokens derived from token-based OAuth. We do this because our authorization code tokens tend to have very high expirations, while our token-based access tokens have very short ones. This pull request solves this problem for us by enabling the user to define an expiration on each app. Since we placed this configuration option inside of a lambda, it could also dynamically customized to vary in different ways.

-David
`end` at 8, 10 is not aligned with `if` at 6, 19