security fix. api_tokens must now be unique.