Add logout functionality

lets the client tell the server to reject the
current access token.