Make token max age configurable

[MorganEPatch]

At present, the maximum age of an auth token is a constant defined in the source. It would be good to make this configurable by some manner.

[pop]

I think another, broader issue, is to have configuration file(s).