Merge pull request #5057 from apache/jwt-exp-by-default

JWT: require valid `exp` claim by default