I just had a discussion with my wife on this - do you have examples of species where there are more than 2 genetic "parents", or do you simply mean that the separation to 2 sexes is the biased part?

Give the token a short grace period (~10-15s). It still works against most token theft attacks but removes the need for a central refresh layer