auth: remove old tokens when authenticating the user

Closes #399.
Closes #400.