user is undefined after revoking refresh token

moved the assign to happen before revoking the token / done