Invalidate token when user signs out