Not sure if this is a feature already and I just missed it.

I noticed the current callback token remains active after I use it to log in. I was hoping to invalidate the callback token immediately after using it. Is there a way to do this? If not, is this a feature you would consider supporting?