there seem to be a problem with token management on
app.pulumi.com/user/settings/tokens - triple dot button doesn't do anything and makes it impossible to invalidate old tokens, not a problem for me but someone who's token leaked would be in hot water