i have a little question.

At the moment my Spring configuration uses the DefaultTokenServices (provided by the spring-security-oauth2-2.0.0.M3.jar).
It generates correctly the access\_token.

Now what i will do is to cancel/delete/remove/revoke this token when i do a logout.

In the security.xml i configured the logout in the http tag:

`<sec:logout logout-url="/logout" logout-success-url="/auth" invalidate-session="true" delete-cookies="true" />`

and the redirection is successfully. But if i write a test doing a login, logout and after i try to access a restricted path with this access\_token i can get a successful request, but i expect a Not authorized Error.
Why?

How can i configure the logout that the access\_token are automatically deleted to force an new login?