Approval#api_token should only retrieve tokens that are unused and unexpired

As pointed out in https://github.com/18F/C2/commit/65f0528209089d85b8928aeabc98766c000e080d#commitcomment-9119694.
I may be inclined to use `active` instead of `fresh`, only because I think of 'newly created' when reading the latter