Also check for collisions in entries which are already expired
Decline token if underlying user was deleted in the meantime
New entry for app role information, list apps.