OAuth2: invalidateToken() revokes the token without checking the client credentials

When I call the `invalidateToken()` function with options:
```
{ 
  clientId: 'invalid-id',
  clientSecret: 'invalid-secret',
  token: '<token>' 
}
```

The token gets revoked even though the `clientId` and `clientSecret` fields are wrong. 

So it seems, that Apigee does not check the client credentials for some reason.