xdg: cleanup activation tokens

[cmeissl]

valid tokens will stay around until explicitly cleaned-up. remove the token after it has been successfully used or we consider it timed out to prevent leaking the memory used by the activation tokens

[YaLTeR]

Thanks