Rename this Servlet to something like PurgeCredentialServlet and add a comment saying that this is not what MyGlass does. The name SignOutServlet gives the impression that the code you provide replicates the process MyGlass goes through to remove a Glassware, which is not the case because you do not revoke the refresh token. Otherwise, LGTM.