Remove Paypal token after it has been used

Yep, now, there's a lot of logic in the controller, that should be moved to services.