CLC-4009 Block token changes when indirectly authenticated

https://jira.ets.berkeley.edu/jira/browse/CLC-4009

This is just the server-side fix. As with CLC-4005, I'd like this to land first for easier QA.

If it checks out OK, a QA PR will follow.