Evict the cache if the JWKS change

[mcollina]

@panva says

what if the keys i resolve are coming from a remote JWKS uri, a key drops out, i shouldn't accept those tokens anymore, regardless of their exp.

[ShogunPanda]

This makes the entire cache useless. Because in order to verify if the token is still valid I need to hit the URL with the JWKS.
I think it's better to outline this in the README instead so that the users can disable the caching layer if they think keys can be evicted before token expirations.

[ShogunPanda]

Additionally, we can probably fix this if we implement the second approach @dgonzalez suggested in #8

[mcollina]

+1 for that second approach Il giorno ven 31 gen 2020 alle ore 12:49 Shogun <notifications@github.com> ha scritto:

…

Additionally, we can probably fix this if we implement the second approach @dgonzalez <https://github.com/dgonzalez> suggested in #8 <#8> — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#5?email_source=notifications&email_token=AAAMXY2RTIJUA7F6IWMYR53RAQF4HA5CNFSM4KNGZYC2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEKONFVI#issuecomment-580702933>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAMXY4EKTXOA4AFFIOYWCLRAQF4HANCNFSM4KNGZYCQ> .

[ShogunPanda]

In order to mitigate this, I've added a cacheTTL option which defaults to 10 minutes.