When calling `create()` with a `exp` timestamp claim present, we should use that for expiration instead of the default 1 hour expiration.