remove deauthorize_url as it's specific to the login server in use and should belong in the app using this client. Add some additional comments in users.js