AccessTokens can be expired / deleted right?  If so, then if a user logs in to get a new one / recreate it, won't this code create a duplicate `ApplicationUser`?