Badly formatted trustedApps setting in API server causes 500 error on login and others

[sgoumaz]

We don't validate the setting when loading the config or when using it (L61 is where it crashes), so that if trustedApps includes stuff such as *https://127.0.0.1*,*http://api.czene.co.uk:3000/* (i.e. missing the @) the caller gets a 500 error on login and other methods involving auth.

TBD: should we raise the error on server startup in the config validation (linked above) or elsewhere?

---

As signalled in customer tickets: Magnes (again here), probably also Accord/Swordfish