We are operating under the assumption that there is only one token per user, but we are not enforcing it anywhere (?). I think we have 3 options:

  - Enforce that in the DB layer (meh…).
  - Sort EFQ by expiration date and get the one that expires the latest, if that one is expired then load all tokens for that user and delete them all. If you don't feel like bringing down the performance of the user thread this can be queued and dealt with later.
  - Have some sort of garbage collection process that removes expired tokens. (Careful, sometimes having an expired token in the server means something different than not having a token at all. Specially when dealing with temporal access windows).

If we don't remove old tokens –i.e. assuming there's only this way to create them– we are coding ourselves into a potentially ever growing table with dead rows.