Ensure only a single api token per user