feat(xo-server/token.create): minimum duration is now one minute

This change also handles negative or zero invalid durations.

packages/xo-server/src/xo-mixins/authentication.mjs

@@ -175,7 +175,9 @@ export default class {
     let duration = this._defaultTokenValidity
     if (expiresIn !== undefined) {
       duration = parseDuration(expiresIn)
-      if (duration > this._maxTokenValidity) {
+      if (duration <= 60e3) {
+        throw new Error('invalid expiresIn duration: ' + expiresIn)
+      } else if (duration > this._maxTokenValidity) {
         throw new Error('too high expiresIn duration: ' + expiresIn)
       }
     }