Make logout invalidate token server-side.

Fixes #1.