add ability to issue tokens with no expiry

codec.go

@@ -41,7 +41,10 @@ func decodePayload(b []byte) (payload, error) {
 
 // expired reports whether the payload's expiry has passed at the given time.
 // Uses >= so a token expiring exactly at `now` is considered expired
-// (the conservative choice).
+// (the conservative choice). Exp == 0 means the token never expires.
 func (p payload) expired(now time.Time) bool {
+	if p.Exp == 0 {
+		return false
+	}
 	return now.Unix() >= p.Exp
 }