On second though, I think you're right. I'll add token invalidation there. It makes the deauth flow cleaner even if it's only here as a development tool.