Reuse merged token and add additional checks.

Make sure we consistently use the same token to check and pass down to
prevent any modification in the meantime between the 2 calls.

The additional checks should fail closer to the source of the problem.

Test: atest BackgroundActivityLaunchTest
Bug: 269228725
Change-Id: I0017d8c24224d9d3ab7a284e81d5ff49630aa8e8