Don't make expiry mandatory

I needed tokens that didn't have an expiry value embedded. I opted to use <<"iat">> instead to keep control on the server side.