Remove token length limits

Turns out the length of access tokens and refresh tokens isn't static: it depends on a whole bunch of things, one of which is number of scopes. Now that it's possible to request up to 60 scopes per token, people are receiving refresh tokens longer than 254 characters which gets truncated when saved. This alters the character field to a text field which has no length limits.