code: func parseTokenConstraints(a ast.Value) (constraints tokenConstraints, err error) {
  	constraints.time = -1
  	var o ast.Object
  	var ok bool
  	if o, ok = a.(ast.Object); !ok {
  		err = fmt.Errorf("token constraints must be object")
  		return
  	}
  	if err = o.Iter(func(k *ast.Term, v *ast.Term) (err error) {
  		var handler tokenConstraintHandler
  		var ok bool
  		name := string(k.Value.(ast.String))
  		if handler, ok = tokenConstraintTypes[name]; ok {
  			if err = handler(v.Value, &constraints); err != nil {
  				return
  			}
  		} else {
  			// Anything unknown is rejected.
  			err = fmt.Errorf("unknown token validation constraint: %s", name)
  			return
  		}
  		return
  	}); err != nil {
  		return
  	}
  	return
  }
docs: // parseTokenConstraints parses the constraints argument.