Comment 4 for bug 1251123

Lowering the expiration solved our problems for now. We no longer see the issues we were seeing at the same rate.
I would consider this a work-a-round, until keystone supports PKI w/o needing to share token state between servers.