I'd like to enforce having one logged in user per device. To do this, on my consumeCodePOST passwordless override

override: {
          apis...
          consumeCodePOST

I was thinking of revoking all sessions for the user before creating a new one. + communicating to the user that a new login attempt happened if

revokeAllSessionsForUser

returns at least one existing handle. does it sound good to you @User ?