> We are operating under the assumption that there is only one token per user

Eventually no - there can be multiple tokens -- and this is were scope/ authorization can play a part. But for now I want to keep it simple.
My though it to have a variable that will decide wether to delete tokens (here and in ``hook_cron()``) or keep as is.