Added invalid refresh token detection.

Also added a manual test button for revoking access and refresh tokens.