Currently for `login` controller, staff's login Expiry date is set to `null`, which indicates token never expires. Allow login caller to set expiry date (should be optional), and check update `checkToken` API to check the expiry date of the token.