In [1271], I made tokens no longer be single-use, but also made sessions expire after 2 weeks.
This is not a sufficient final solution, because a token created a few minutes before a session's 2-week expiration time, will then immediately expire. Even with year-long sessions, this would be a problem.
Ideally, tokens from old sessions would last for x amount of time, but a new session would have to be created in order for a new token to be crated.
But since the security system is tied to authentication anyway-- that's still the missing link. So really, we should probably just have infinite sessions (login in lyceum/wordpress is infinite) until logout.
i'll sleep on it.
see ticket:729