OAuth2: Don't call get_token with empty ID
OAuth2: Manual token revocations

Clients may now revoke tokens when they are finished. Though
not required, revocation allows clients to "dispose" of no
longer needed credentials.

This implements RFC 7009