Support basic client api tokens
Allow clients to have access revoked