This is the direction I steer all my customers these days. Then in the user's account screen I let the user see a list of their device authorizations and they can individually delete those... I really think tokens are the way to go in nearly every case.