Adjust user-api to not delete the old token on token refresh

@kentquirk simple PR for the changes we discussed to user-api.