Clarify confirmation token expiry

doc/security/user_email_confirmation.md

@@ -14,6 +14,11 @@ they confirm their email address.
 In **Admin Area > Settings** (`/admin/application_settings/general`), go to the section
 **Sign-up Restrictions** and look for the **Send confirmation email on sign-up** option.
 
+## Confirmation token expiry
+
+By default, a user can confirm their account within 24 hours after the confirmation email was sent.
+After 24 hours, the confirmation token becomes invalid.
+
 <!-- ## Troubleshooting
 
 Include any troubleshooting steps that you can foresee. If you know beforehand what issues