Helper function expired() prone to race condition

[sudowork]

This may or may not be an issue depending on how you view it.

If you take this approach:

// Sample of a JSON access token (you got it through previous steps)
const tokenObject = {
  'access_token': '<access-token>',
  'refresh_token': '<refresh-token>',
  'expires_in': '7200'
};

// Create the access token wrapper
let token = oauth2.accessToken.create(tokenObject);

// Check if the token is expired. If expired it is refreshed.
if (token.expired()) {
  token.refresh()
  .then((result) => {
    token = result;
  });
}

Then there is an inherent race condition when checking the expiration time against the time the token actually expires:

1. Server creates access token with expiration time (for example 7200 seconds from time t0)
2. Response is received and processed by the client after time t_l1
3. Client checks if token is expired (not expired according to the client) and issues its next API request.
4. Server receives and checks access token expiration after time t_l2, sees that token has expired.

There is a window of time where the latency of t_l1 + t_l2 (plus a ton of other small contributors to latency) could cause the client to use the access token, but for the server to reject it due to expiration.

One approach to fixing this would be to add a buffer; however, I can definitely see this being an issue for the consumer of the simple-oauth2 library to solve. Thoughts @jonathansamines ?

[jonathansamines]

The corresponding documentation was already added in #140