Since revoke permission is a form of update permission, could/should we not eliminate the DELETE endpoint and simply allow for revoking by way of PUT?