Add a setting to limit the maximum number of active access tokens a user may have. Once hit users will need to delete tokens prior to creating new ones.