Fix refresh_token check

[patrickbergman]

Fix the refresh token check with help of carbon package.

The $now = time() + 300 results in an integer, while the $token->expires_in is a datetime string. This check will therefor always fail.

With this change it will just look at the expires_in date and checks if it is in the past or not.