Suggestion: Check what other larger websites (e.g. Google, Amazon, etc.) do with their password requests (if multiple tokens are valid at once). I think they have enough experience with that.