Implemented AccessToken.revoke_for to allow individual token revocation

This would be the first step in resolving issue #303. Feedback on how/if an endpoint should be created? Perhaps something like the originally suggested POST /oauth/revoke with {id: 'test', token: 'tdet3325xe5vD65S'}?