now have an endpoint that will reset all user tokens. This can be called once a week from a cronjob
edited TODO comments