Revoke Token

RFC 7009 token revocation. Revocation applies only to the submitted token: revoking a refresh token does not revoke related access tokens, so callers must revoke both tokens to end both credentials. Public clients send client_id. Confidential clients authenticate with client_id and client_secret in the form body (client_secret_post). For a valid client and well-formed request, returns 200 even if the token is unknown, to prevent token enumeration.