* Added support to the Python client to allow the nonce to be set in
  the auth URL
* Added a client parameter to allow JWT expiry to be configured.
* Updated some tests to check nonce validation.

* Client now throws an exception if an out of range expiry
  was given on initialization; the value is furthermore
  clamped to between 0 seconds and 5 minutes where it's used.
* Doc strings have been updated to reflect what the underlying
  OIDC API specifies around the state and nonce.
* Tests have been added to verify that the expiry is checked
  correctly.