If we continue deleting expired tokens, we might not record whether the token was used or not, and not know what to do in case of a double-refresh. Revoked tokens are safe to delete. This also reduces the frequency of the cleanup job to once an hour.