Be robust to token revocation

[martinbonnin]

Sometimes a token is revoked and the app is in a bad state forever until the user logs out.

I think:

• the backend needs to return a specific code in that case.
• the apps must sign the user out when that code is received.