Confirm that we hit the right URL when revoking tokens.

Require token revoke endpoints to return JSON with a `tokenRevoked` key,
to avoid being fooled by endpoints that don't understand token
revocation but just happened to return 200 status codes.