improve security (#2661)

* disable basic auth when password auth disabled

* clarify otl security

src/server/routes/cnf/[oneTimeLink].ts

@@ -14,6 +14,13 @@ export default defineEventHandler(async (event) => {
     });
   }
 
+  if (new Date() > new Date(otl.expiresAt)) {
+    throw createError({
+      statusCode: 410,
+      statusMessage: 'One Time Link has expired',
+    });
+  }
+
   const client = await Database.clients.get(otl.id);
   if (!client) {
     throw createError({