Handle 10486

- Save redirect url to token
- Delete token only after successful authorize
- Add accessors to Token that take transaction_id instead of token