According to the database table for oauth_access_tokens, the access & refresh token only have one revoked field, so they cannot be individually revoked. Can it be made clear that by passing the refresh/access token for revocation, it will also revoke it's counterpart (RFC7009-2.1 seems to imply that they can be done seperately)? @tute thoughts?