* add a specific error in case of wrong app token, fix #3457
* prevent regeneration of api/user tokens when not requested, fix #3458
* add tests for app_token