Approval#api_token should only retrieve tokens that are unused and unexpired

As pointed out in https://github.com/18F/C2/commit/65f0528209089d85b8928aeabc98766c000e080d#commitcomment-9119694.
Open to better name ideas :grin: