Is there a way to block our son's ability to purchase tokens or password protect it?

In all honesty, it would be highly possible for users to have a setting in the Status Meter to select for password protecting token purchases, thus making it impossible to purchase via the status meter without inputting the password.  As for buying from the CCS, a similar approach could be taken requiring the last four digits of the customers Debit/Credit card that is on file...

Or best yet, just have an Opt-Out on the system to restrict token purchases entirely.