add timeout option that will gitea invalidate the token for better UX the token should not be deleted if created manually by the user and there shoukd be an option to reenable and extend the timeout