Revokes an access token or refresh token (and its refresh-token family) on behalf of the client it was issued to, sent as application/x-www-form-urlencoded. The client must authenticate as at token exchange (401 with invalid_client otherwise). Returns 200 with an empty body whether or not the token existed, and does nothing for a token issued to another client.