Explicitly revoke refresh token upon logout