fix: blacklist tokens

- Make sure we blacklist tokens only on authorization failures

- In other cases, just log and exit