RFC 7009 - OAuth 2.0 Token Revocation

# Feature

##   RFC 7009 - OAuth 2.0 Token Revocation   
                                           
##    http://tools.ietf.org/html/rfc7009     

    
This revocation mechanism allows a client to invalidate its tokens if the end-user logs out, changes identity, or uninstalls the respective application. Notifying the authorization server that the token is no longer needed allows the authorization server to clean up data associated with that token (e.g., session data) and the underlying authorization grant. This behavior prevents a situation in which there is still a valid authorization grant for a particular client of which the end-user is not aware. This way, token revocation prevents abuse of abandoned tokens and facilitates a better end-user experience since invalidated authorization grants will no longer turn up in a list of authorization grants the authorization server might present to the end-user.
    
The client requests the revocation of a particular token by making an HTTP POST request to the token revocation endpoint URL :
```POST /oauth/revoke?token={token}[&token_type_hint=(access_token|refresh_token)]```
The client also includes its authentication credentials in the HTTP header as described in Section 2.3. of [RFC6749]. It is the {doorkeeper_token}
    
`{token}` REQUIRED. The token that the client wants to get revoked.
`{token_type_hint}` OPTIONAL. A hint about the type of the token submitted for revocation. Clients MAY pass this parameter in order to help the authorization server to optimize the token lookup. If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types. An authorization server MAY ignore this parameter, particularly if it is able to detect the token type automatically. This specification defines two such values:
     * access_token: An access token as defined in [RFC6749], Section 1.4
     * refresh_token: A refresh token as defined in [RFC6749], Section 1.5

The token {token} can be an access token or a refresh token. If the token is an access token and it has a corresponding refresh token, the refresh token will also be revoked.
If the revocation is successfully processed, then the status code of the response is 200. For error conditions, a status code 400 is returned along with an error code.