fix routes /revoke instead of /token/revoke