Move revoking of client credentials up into Credentials manager