Block access if the token is revoked (but not expired) #203
Description
Currently we only check the validity of an access token by verifying its signature and expiry time. But we should also check the token introspection endpoint of the authorization server, e.g., to figure out if the token is revoked.