title: Oauth2/Openid Connect. How to revoke unknown access/refresh tokens
body: <p>In Oauth or Openid Connect, let's say an attacker takes an access or refresh token and the browser or app's caches are cleaned.  Can a user revoke an access or refresh token issued by an Identity Provider if their string is not explicitly known?</p>