added test cases for token revocation upon user deactivation