fix the refreshToken never expire bug

[jydxh]

add the expiredIn attribute in the Token Schema, and use this date as reference, pass it into the cookie expires props, so the refreshToken will have an expired date as per value saved in DB.
Also, when user login, the refreshToken, and the expiredDate will be updated and save in DB.

[jydxh]

also, change the jwt.sign and jwt.verify into async way, so it wont block the I/O