Client calls revoke-token endpoint on logout