Fix mistakes regarding what happens if `expires_at` is not defined in
two situations.

* Creating tokens: maximum allowable time
* Rotating tokens: one week

We use the same language everywhere for consistency.