Token is correctly rotated on the server, it just isnt correctly removed on the client. closes #5940
files.create