Improved token expiration management #338
Description
For some reason DOT decided against using the proper OAuthLib way of dealing with token timeouts, and instead overrides the timeout during store_bearer_token in the validator. This approach makes it really difficult to dynamically change the token timeout depending on the request.
More than that, it is also not the way OAuthLib suggests this should be done: the "proper" way is to either override the OAuthLib token class, or simply pass token_expires_in parameter to the Server constructor (which will eventually get to the BearerToken constructor). This parameter may be a callable taking request as a parameter and returning the expiration time in seconds.
I suggest that instead (well, in a backward compatible manner) of today's ACCESS_TOKEN_EXPIRE_SECONDS setting we add an ACCESS_TOKEN_EXPIRES_IN, which may either be a number of seconds or a function taking request and returning seconds. Internally, this value will simply be passed in the Server constructor in the OAuthLibMixin.get_server
Another good outcome is that it will allow getting rid of this bad pattern and a pending TODO