Expire old tokens from trusted clients separately from creating a token

Separate out the list of client ids that can log in using the OAuth2 Resource Owner Password Credentials Grant from the list of those client ids that we want to expire as the client doesn't hold on to the token that we gave it.

**Note:** The live and test's api's config.php must be updated with the new config key before deployment.