add a way to destroy tokens

fixes #83 

@warner or @fmarier r?
Is there a good way to verify that the token has actually been removed? I commented out the actual `db.removeToken()` call in destroy.js, and the tests still passed.