Same comment as above: the token endpoint may be down. We should be more selective when to remove tokens. A reasonable heuristic would be that the server gave us well-formatted OAuth2 error.