Fix service tokens, idempotent around spaces&orgs&tokens