Revoke a token the moment it leaves your hands

Revoking takes effect straight away and touches nothing else: the client using that token loses access, every other one keeps working, and nobody changes a password over it.