Review token scope before rotating a credential.

Rotate credential

The old credential stops working immediately.