PurpleXtra staff only. Actions are also checked server-side and refused otherwise.
Credits the recorded tokens to the account. A new client receives a set-password link; an existing client receives a balance note. Marking the same invoice twice never double-credits.