Additional delete/revoke token endpoints for Oauth2

Requirements from customer to provide an alternative to the : DELETE /frrest/oauth2/token/ endpoint.

High level requirements:

This new endpoint should,

1) Not require a SSOToken, or at least not require that the user re-login to get a SSOToken.

2) Revoke all a users' tokens using refresh token.

• API is called with valid access token -> OpenAM revokes that access token and associated refresh token.
  -API is called with valid refresh token -> OpenAM revokes that refresh token.

3) Subsequent attempts at access via a revoked token will be denied.

4) Subsequent attempts to access using a different valid token (e.g having initiated logout from a webpage, and then attempting access via a mobile app) then their access is permitted.

5) API only allows a user to revoke their own tokens. It should not allow a user to revoke tokens other than those detailed here.