JCKodel the code in CollectGarbage
is not only inefficient, it's actually completely broken and was non functional, see flarum/core2075 . It's been a known issue for a while and it's been replaced by a new strategy in Flarum beta 16.
Pre-beta 16, you could customize the lifetime of a token at the time of creation.
This is no longer possible in Flarum beta 16. Instead Flarum beta 16 introduces custom token types, where each type can register its own expiration logic. There are no extenders shipped for it in beta 16, but there will be official extenders in the next release. In the meantime it's possible to call the code directly, feel free to ping me if you need details on how to register custom token types on beta 16.
Regarding the 5 years remember sessions, I created this separate issue to collect feedback flarum/core2659 I'm suggesting we reduce it in the upcoming Flarum release.