Repository: feathersjs/feathers-authentication (js)

Issue:
Token creation has side effect
With an auth config such as: 

```json
{
  "auth": {
    "secret": "...",
    "jwt": {
      "issuer": "...",
      "audience": "...",
      "expiresIn": "7d"
    }
  }
}
```

Calling  only once `app.service('/authentication').create({payload: {userId: _id}, jwt: {expiresIn: '10m'}})` internally will produce a side effect which is that subsequent create call (such as the `app.authenticate()` sent by the feathers-client) will generate tokens with `10m` expiration instead of `7d`.

Modules:
```json
    "feathers": "^2.0.3",
    "feathers-authentication": "pre",
    "feathers-authentication-jwt": "^0.3.1",
    "feathers-configuration": "^0.4.1",
    "feathers-errors": "^2.5.0",
    "feathers-hooks": "^1.7.1",
    "feathers-hooks-common": "^3.0.0-pre.1",
    "feathers-legacy-authentication-hooks": "^1.0.0",
    "feathers-mongoose": "^5.0.3",
    "feathers-rest": "^1.6.0",
```

Pull request description:
Fix #454 Token create has side effect
see #454 

Patch:
diff --git a/src/service.js b/src/service.js
index 415f78a..b863483 100644
--- a/src/service.js
+++ b/src/service.js
@@ -19,7 +19,7 @@ class Service {
     // TODO (EK): This should likely be a hook
     // TODO (EK): This service can be datastore backed to support blacklists :)
     return this.passport
-      .createJWT(payload, merge(defaults, params))
+      .createJWT(payload, merge({}, defaults, params))
       .then(accessToken => {
         return { accessToken };
       });


Test patch:
diff --git a/test/service.test.js b/test/service.test.js
index 67352c3..234cf46 100644
--- a/test/service.test.js
+++ b/test/service.test.js
@@ -88,6 +88,26 @@ describe('/authentication service', () => {
         expect(result.accessToken).to.not.equal.undefined;
       });
     });
+
+    it('creates multiple custom tokens without side effect on expiration', () => {
+      const params = {
+        jwt: {
+          header: { typ: 'refresh' },
+          expiresIn: '1y'
+        }
+      };
+
+      return app.service('authentication').create(data, params).then(result => {
+        return app.service('authentication').create(data).then(result => {
+          return app.passport
+            .verifyJWT(result.accessToken, app.get('auth'))
+            .then(payload => {
+              const delta = (payload.exp - payload.iat);
+              expect(delta).to.equal(24 * 60 * 60);
+            });
+        });
+      });
+    });
   });
 
   describe('remove', () => {