Fix login fail if duplicate token request

[filipcekic]

in some cases, when user tries to login, duplicate token request is made. with the current pop() method, first request will verify token and delete it, and then when other (duplicate) token request arrives - token is not existing (deleted by first request) and therefore login will fail.

Changes were done to pop() method:

• do not remove token upon verification (stays in db)
• remove expired tokens before verification (this is just to clean expired tokens from db)

[CLAassistant]

All committers have signed the CLA.