Use the time an access_token was created to expire it before going to the server

[cketcham]

Instead of trying a request and failing due to an auth error, it would be better if the authenticator looked at the expiration time and invalidated the token before using it.