Revoke used tokens atomically.

This should prevent replay attacks on TOTP and SOTP.