Allow the creation of access token to be overriden

/to @ritch 

This PR allows us to customize the access token creation so that we can calculate the TTL based on the current user/application and other context.
This won't use the correct `User` object for inherited classes. Use `var User = this.constructor` instead.