Support specifying a lifetime for an access token

[Half-Shot]

I tried to do a little digging for this, but I was a bit lost in the specs for Open ID. I'd like to be able to specify that a session can only live for so many seconds before expiring and requiring the user to reauthenticate. This is specifically to be used with #1563, so that a user can authenticate as another user for a short time.

[Half-Shot]

I think what I am describing is the refresh tokens flow, with some configuration wiggling. I suspect nothing needs to be done for this issue?

[Half-Shot]

In practice we are managing to do this.