Is there a way to block our son's ability to purchase tokens or password protect it?

Don't remember for Windows 7 but with 8.1 you can setup a child's user account which restricts usage and can also have it so the Status Meter doesn't even appear.