Fix and test token revocation list API

Change-Id: I6c60bf2aecc7c9353e837e59a4e09860d049e0f5
(cherry picked from commit 775d7a7802bd5cf49880c8a76e9a175e8470adba)
Fixes CVE-2013-4294