you should penalize the user heavily for an invalid token, see cmd_oper:
`user->CommandFloodPenalty += 10000;`