Revoke a grant

RFC 7009. Always 200, even for a token that was never issued — a client cleaning up after itself must not be able to use this endpoint to discover whether a token string is real. The secret half must still match the stored digest, or knowing a prefix would be enough to disconnect somebody else's assistant.

Revoking either half of a pair takes the whole grant down. A client asking to be disconnected means it.