Only allow a token to revoke itself, not other tokens with the same (resource owner, app)