Limit total number of devices connected to an account

(Not ready for merge)

Per #130 we need a way to limit the number of devices simultaneously connected to an account.  As a start, here's a dedicated error code that can be used to report this condition to the client.  Let's use this branch to flesh out the code to support it.

@dannycoates are there other token types that we should limit in a similar way to sessionToken?