2020-11-17 UTC
# 
jamietanna regarding revocation, the token should trace back to some initial request (I'll be doing it based on the Pushed Authorization Request) so an access/refresh token that comes in requesting a revoked authorization will be rejected