OAuth: Set `created_at` in token exchange response