ClaimsAccessor#getClaimAsInstant -> use seconds for Long type

[jzheaux]

Summary

In the JWT spec, NumericDate is defined as [1]:

A JSON numeric value representing the number of seconds from
1970-01-01T00:00:00Z UTC until the specified UTC date/time,
ignoring leap seconds.

And in the OAuth2 spec, expires_in is defined as [2]:

The lifetime in seconds of the access token.

However, ClaimsAccessor#getClaimAsInstant uses a millisecond unit of measure:

Instant.ofEpochMilli(Long.valueOf(this.getClaimAsString(claim)));

[1] - RFC7519 - Terminology
[2] - RFC6749 - Access Token Response

Actual Behavior

When a JWT is parsed, the "exp" field is interpreted as being milliseconds. For example, ClaimsAccessor interprets 1522571389 to be January 18, 1970 14:56:11 UTC.

Expected Behavior

Given the same timestamp, ClaimsAccessor interprets it to be April 1, 2018 08:29:49 UTC.

Version

5.1.0.M1