text: Title: User can delete other users' access tokens
  Body: ### Steps to reproduce ###
  - Log in as two different users and take note of the access tokens
  - Execute `curl -X POST -H 'Authorization: Bearer <access_token_of_user_1>' -H 'Content-Type: application/x-www-form-urlencoded' --data 'token=<access_token_of_user_2>&token_type_hint=access_token&client_id=<client_id>' http://your.host/oauth2/revoke_token/`
  
  It's maybe very unlikely that anyone obtains other users' access token, but it still doesn't seem right to be able to terminate other users' session.
  