Check if the app that requested a token has provided a valid input
serial and a focused surface. Downgrade activation request to urgency
otherwise.
This is mostly in line with what other Wayland compositors decided to
do, and offers a better security than the original logic.