anchor.diff:  --------------------------------------------------
   
   [[security-api-invalidate-token]]
  -The tokens returned from this API have a finite period of time for which they
  -are valid and after that time period, they can no longer be used. However, if
  -a token must be invalidated immediately, you can do so by submitting a DELETE
  -request to `/_xpack/security/oauth2/token`.
  +If a token must be invalidated immediately, you can do so by submitting a DELETE
  +request to `/_xpack/security/oauth2/token`.  For example:
   
   [source,js]
   --------------------------------------------------
  
positive.code: --------------------------------------------------
  // TESTRESPONSE[s/dGhpcyBpcyBub3QgYSByZWFsIHRva2VuIGJ1dCBpdCBpcyBvbmx5IHRlc3QgZGF0YS4gZG8gbm90IHRyeSB0byByZWFkIHRva2VuIQ==/$body.access_token/]
  
  A successful call returns a JSON structure that shows whether the user has been
  created or updated.
  
  The token returned by this API can be used by sending a request with a
  `Authorization` header with a value having the prefix `Bearer ` followed
  by the value of the `access_token`.
  
negative.code: --------------------------------------------------
  // CONSOLE
  
  The following example output contains the access token, the amount of time (in
  seconds) that the token expires in, and the type:
  
  [source,js]
  --------------------------------------------------
  