auth
auth/.hgignore
Drop RemoveToken, test RevokeToken for refresh tokens. The RemoveToken function was never actually used, and there's no reason to use it. Tokens are revoked, not removed. So I deleted it. And while I was updating the tests, I finally inserted the test for revoking a refresh token, mainly to get rid of that damn TODO.