It appears another situation where multiple access tokens for the same oauth client can exist is in situations where the access token is stored client-side rather than server-side, and the user has multiple devices, though I'm not sure how well that applies to us. But it generally seems like allowing multiple access tokens for the same origin+user combination to exist at once provides freedom without necessarily making things less secure (and if used for privilege separation, can even make things more secure).