Add DELETE method to /auth/

Authenticated `DELETE` requests to `/auth/` should invalidate the session linked to that token.