Only creates one token per user now