Avoid assuming that time_t can fit in an int.

 Avoid assuming that time_t can fit in an int.
 
 We had several places that used cast-to-unsigned-int as a substitute
 for properly checking for overflow.  Coverity has started objecting
 to that practice as likely introducing Y2038 bugs.  An extra
 comparison is surely not much compared to the cost of time(NULL), nor
 is this coding practice particularly readable.  Let's do it honestly,
 with explicit logic covering the cases of first-time-through and
 clock-went-backwards.
 
 I don't feel a need to back-patch though: our released versions
 will be out of support long before 2038, and besides which I think
 the code would accidentally work anyway for another 70 years or so.