Check for existing token during two-factor login

OAuth2 token notes must be unique so without this check a
login from a 2nd device will fail when it tries to create an
authorization and one already exists.