add "exp" to token

[line-o]

Currently only "iat" - for issued at - is added to the token when it is created.
Many JWT-implementations also add the "exp" - expires at - timestamp as well.