Logout with an access token in the authorization header

[DamirSvrtan]

I believe this is missing - we only logout users if they send out cookies, however the user can send out an access token in the authorization header we need to delete that access token also.

@edjiang @omgitstom close this if I'm wrong.

[nbarbettini]

I agree, this should be tested.