users.createToken does not respect OTP required for admin Personal Access Tokens

Description:

If I call the api 'users.createToken' with headers={"X-User-Id": admUserId, "X-Auth-Token": some_personal_access_token_with_otp_required} , json= {"username": userToDisable}) , the access token for the user is created BUT it shouldn't. The call should fail because my personal access token requires OTP.

Steps to reproduce:

1. Create a personal access token for some admin user and set OTP as required ( default )
2. Try to create a token for another user using the admin personal token
3. the operation will be sucessful

Expected behavior:

It should fail due missing OTP.

Actual behavior:

The token for the user will be created.

Server Setup Information:

• Version of Rocket.Chat Server: 3.11
• Operating System: k8s
• Deployment Method: k8s
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version: 4.0.20

Client Setup Information

• Desktop App or Browser Version: N/A

Additional context

Relevant logs:

Start at the users.createToken API entry point and reproduce the request with an admin personal access token that requires OTP. Done means the operation rejects the request when OTP is missing instead of creating the other user's token.