remove old tokens if a new one is requested
display active tokens on profile page
tokens can be revoked
fix token existence check