refactor the code and add revoke token support on logout