Currently, CO Service Tokens are implemented as an experimental AvailablePlugin. Consider the following enhancements/changes:

1. Convert from plugin to core code, enable via CO Settings
2. Add support for revoking (unsetting) a token.
3. Define a provisioning action enum and maybe provide the token to the provisioner only for that enum.
4. Add support to LdapProvisioner to write token (may require attribute options?)
5. Add a link from CO Person canvas to assign tokens (same link as "My Identity" dropdown)
6. Add hasMany relations from CoPerson and CoService, so dynamic binding is no longer required in CoServiceToken[Setting]sController.