oauth2: inaccurate expires_in time

[jmwong]

Looking at https://github.com/ory-am/fosite/blob/master/handler/oauth2/flow_authorize_code_token.go#L106, it always uses c.AccessTokenLifeSpan, even when it's been overridden in a custom HMACSession (as suggested here): https://github.com/ory-am/fosite/blob/master/fosite-example/main.go#L199

[aeneasr]

nice find, thanks

[aeneasr]

on a side note: this shouldn't be uber critical as the exp in the token response is a suggestion. that's also the reason why the timestamp isn't absolute but relative. oauth2 clients should be able to deal with expired token without having to rely on the exp value. nevertheless I will fix this ;)

[aeneasr]

One issue here is that we don't know what session type we are encountering here, this is therefore a bit tricky to solve, if we don't want to couple the oauth2 handler logic with the session logic.