Authentication token manager with expiry

Build a manager for tokens that live for a fixed time: generate(id, now), renew(id, now) which only works on a token that has not expired, and count_unexpired(now). Discuss how expired tokens are cleaned up and how to make the count fast.