Customize token flow OAuth expirations with a config lambda

At NationBuilder, we assign a custom expiration to access tokens derived from token-based OAuth. We do this because our authorization code tokens tend to have very high expirations, while our token-based access tokens have very short ones. This pull request solves this problem for us by enabling the user to define an expiration on each app. Since we placed this configuration option inside of a lambda, it could also dynamically customized to vary in different ways.

-David
A third one: I don't like to extract this module outside of `AccessToken`. I think this is quite relevant behavior and should be explicit in the `AccessToken` class.