There should be a setting in package so that when user log in on new device and new token issued to him, his previous tokens expire.