But anything that can steal money using that token and 5 minutes is a very long time indeed.

Then implement a check for the token in destructive operations. Should keep the performance impact pretty low.