users can revoke access to refresh token

[scott-22]

If users revoke access to the refresh token, the app should log them out and have them give consent again. It currently only reconfirms login for consent if the refresh token is null.