Introspect API does not honour token revocation

[ThorodanBrom]

The introspect API does not know about revoked tokens. If a revoked token is introspected, it would return the decoded token successfully. If this is to be changed:

• revoke token API needs to update a column/table in the DB
  • need to store for each server? This complicates things
• introspect API needs to check the table after decode
  • again, if stored for each server, will need to check aud field + userId

[ThorodanBrom]

If the solution is implemented, it would solve another problem.
In the case where a server does not respond to a token revocation, or responds incorrectly:

• /token/revoke will end with an error saying tokens were not revoked. This isn't ideal.
• client secret regeneration ignores the failure and carries on

Implementing the table that contains user + server + timestamp can allow us to expose an API that can perhaps be called by servers in the cases when they experienced downtimes or were offline and could not respond to revocation requests.