SSP-1387 Invalidate Client-only OAuth2 tokens on critical edits

Still need to address Client soft-deletes.