revoking a token is a global API method, not a host factory method
actually implement revoking a token