Bugfix: revoked key doesn't trigger new key request

This fixes the case where an OAuth key is revoked on the server side, and before the key expires, the client tries to use it.  The library was to continuing to use the invalid key.

The new behavior is this: if the key has already been attempted and denied once, the it must be invalid, so it is deleted from persistence and a new key is requested.