Enable client to specify shorter token expiry

[danielballan]

Quoting the docs:

You may configure:

• The maximum time to keep an inactive session alive (default is one week)
• The maximum session lifetime (default is unlimited)
• Access token lifetime. This is internal from the user’s point of view It should be short. (Default 15 minutes.)

This are global server-side configuration settings. Should we enable the client to request a session with different parameters? The use case is, on my personal laptop, I want Tiled to me logged in so I am not re-prompted every time I restart a Jupyter kernel or an IPython session. On a beamline machine, I might want Tiled to quickly time out my session if I step away. This should be specified at time of login, when the credentials are presented.

[danielballan]

Interested in input for @dylanmcreynolds and others