add a way to destroy tokens

fixes #83 

@warner or @fmarier r?
This `client.secret` is really pre-hashed, right? Maybe in a separate PR we should clean that up and name this field `hashedSecret` instead. Then maybe `eq` should get renamed too, `equalToHashed` maybe? "eq" suggests symmetry.