Ensure token is removed in persisent mode on validation
Ensure token is removed in persisent mode on validation

When the token is successfully validated and we are not in persistent
mode, then we need to remove the token. This is a separate operation to
handling failure.

The side-effect of the previous code is that is allowed a replay attack
where the same token could be used multiple times even when persisent
mode was disabled.

Thanks to Xhelal Likaj (https://github.com/xhlika) for the report.

slimphp/Slim-Csrf,akrabat/Slim-Csrf