Hi Søren,
You already covered most of it. When the client accesses an object, the server provides the change token in the cmis:changeToken property (if the client asked for it and server supports change tokens).
When a client changes an object (updates properties, sets new content, etc.) and includes the change token in the request the server should check if this change token matches the current change token of the object. If it does, the object hasn't changed since the client accessed the object and the update can be performed. If it doesn't match the server should return a updateConflictException. That signals the client that another user has modified the object in between. It's then up to the client to refresh the object, just override the other users changed (by retrying the update request without change token), or giving up.
Regards,
Florian Müller