oauth: add destroy action to json api