Change TOKEN_MAX_AGE to accept timedelta and default to 15 minutes. (#1233)