System creates unwanted API token

During the past two years or so I've experienced several times that an API token was created for my user (superuser) without me clicking on the Create Token button.

To illustrate the latest occurrence of this behavior: This morning I created an API token which I needed to run a regular API script. After I ran the script, I revoked the token. I even clicked on other buttons on the page, refreshed the page, and navigated back to check whether no token was defined anymore. The token I used in the script started with "7d2a". When I checked this evening, a new token starting with "2c4d" was displayed.

What steps does it take to reproduce the issue?

1. Click on your username on the top right of the Dataverse page.
2. Click on API token.
3. Create a token and run an API call.
4. Revoke the token.
5. After a while, return to the API token page.

• When does this issue occur?
  Sporadically, as described above.

• Which page(s) does it occurs on?
  The API Token page.

• What happens?
  See description above.

• To whom does it occur (all users, curators, superusers)?
  I've only tested this as a superuser.

• What did you expect to happen?
  The token being permanently revoked and no new token being created until I create a new one.

Which version of Dataverse are you using?
5.13

Any related open or closed issues to this bug report?
No.

Screenshots:
No.

Start at the API Token page and reproduce the create, API-call, revoke, and return sequence described in the issue. Trace the token lifecycle to determine why a token appears without a new click; the fix is complete when a revoked token stays absent and no replacement is created unexpectedly.