Set expires at for password credentials flow

[beornf]

Noticed that expires at is not set in the session by default unlike the authorize code, client credential and refresh flows.

[coveralls]

Coverage increased (+0.02%) to 80.511% when pulling 49a58f6 on beornf:password-expiry into fa50c80 on ory:master.

[aeneasr]

Thank you! Would you mind adding a (failing) test case for this too?

[coveralls]

Coverage increased (+0.05%) to 80.542% when pulling bcf912a on beornf:password-expiry into fa50c80 on ory:master.

[beornf]

Added a failing check to the final test case.

[aeneasr]

perfect, thank you!

[kujenga]

Hmm, I just upgraded our fosite dependency and this PR seems to have broken my app's use of fosite. The expiration time set in the session, which seems like it should be preferential, is now overridden by this value.

Previously, the behavior used the expiration times in the session set here:

fosite/session.go

Lines 46 to 69 in dd9398e

	// DefaultSession is a default implementation of the session interface.
	type DefaultSession struct {
	ExpiresAt map[TokenType]time.Time
	Username string
	Subject string
	}
	func (s *DefaultSession) SetExpiresAt(key TokenType, exp time.Time) {
	if s.ExpiresAt == nil {
	s.ExpiresAt = make(map[TokenType]time.Time)
	}
	s.ExpiresAt[key] = exp
	}
	func (s *DefaultSession) GetExpiresAt(key TokenType) time.Time {
	if s.ExpiresAt == nil {
	s.ExpiresAt = make(map[TokenType]time.Time)
	}
	if _, ok := s.ExpiresAt[key]; !ok {
	return time.Time{}
	}
	return s.ExpiresAt[key]
	}

I can work around this be setting the configuration variable to the access token time that we want, but that seems to defeat the purpose of the custom expiration times in the session.

[kujenga]

Unless I was perhaps misusing the ExpiresAt map before? I was pre-filling values and expecting those to be respected/used.

[aeneasr]

This might be #211

[beornf]

In the case of pre-filling the session expiration time it might help to wrap all session expiration time setters with a nil check:
if request.GetSession().GetExpiresAt(fosite.AccessToken).IsZero() ...