Properly handle non-existent tokens in Token Invalidate API #53323
Description
Invalidate Token API does not handle malformed and non-existent tokens correctly. It returns a 400 could not refresh the requested token if it can decode the refresh token and a 401 token malformed if the token document doesn't exist. The latter can happen in cases where we have already deleted the token document because the access token is expired/invalidated and the caller is not aware, or when we get a token that is malformed or not ours.
In all above cases we should be returning 200 with a body of
{
"invalidated_tokens":0,
"previously_invalidated_tokens":0,
"error_count":0
}