how would SP handle a stolen token or rather i guess how does the spec (OATH) suggest how to handle this