Add freshness to auth tokens

[jwag956]

This enables us-setup to be totally functional with auth tokens (not requiring a session cookie).

• Authentication tokens now carry freshness information - namely the timestamp that the client/user successfully authenticated.
• Both sessions and auth tokens place the timestamp into a request global - fs_paa
• @auth_required() freshness checking looks at the request global - a config parameter SECURITY_FRESHNESS_ALLOW_AUTH_TOKEN can be set to False which forces any request using an auth token to be 'not-fresh' (the previous behavior).
• Removed code for freshness 'within' == 0 - which was a hack for testing - we have better testing utilities now.
• fixed/improved example for unified signin.
• doc improvements...

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 98.44%. Comparing base (80a7139) to head (c44d6a2).

Additional details and impacted files

```diff @@ Coverage Diff @@ ## master #990 +/- ## ======================================= Coverage 98.44% 98.44% ======================================= Files 36 36 Lines 4621 4622 +1 ======================================= + Hits 4549 4550 +1 Misses 72 72 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.