anchor.diff:  --------------------------------------------------
   
   [[security-api-invalidate-token]]
  -The tokens returned from this API have a finite period of time for which they
  -are valid and after that time period, they can no longer be used. However, if
  -a token must be invalidated immediately, you can do so by submitting a DELETE
  -request to `/_xpack/security/oauth2/token`.
  +If a token must be invalidated immediately, you can do so by submitting a DELETE
  +request to `/_xpack/security/oauth2/token`.  For example:
   
   [source,js]
   --------------------------------------------------
  
positive.code: --------------------------------------------------
  // CONSOLE
  
  .Token Request Fields
  [cols="4,^2,10"]
  |=======================
  | Name        | Required  | Description
  | `username`  | yes       | The username that identifies the user.
  | `password`  | yes       | The user's password.
  | `grant_type`| yes       | The type of grant. Currently only the `password`
                              grant type is supported.
  | `scope`     | no        | The scope of the token. Currently tokens are only
                              issued for a scope of `FULL` regardless of the value
                              sent with the request.
  |=======================
  
  A successful call returns a JSON structure that contains the access token, the
  amount of time (seconds) that the token expires in, the type, and the scope if
  available.
  
  [source,js]
  --------------------------------------------------
  
negative.code: --------------------------------------------------
  // TESTRESPONSE[s/dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==/$body.access_token/]
  
  The token returned by this API can be used by sending a request with a
  `Authorization` header with a value having the prefix `Bearer ` followed
  by the value of the `access_token`.
  