If a user has any authorized applications, the apps tab appears on their profile pages.

From the page linked a user can see their authorized applications, and de-authorize any of them.

That link probably won't be conditionally displayed forever, but we haven't got anything to show in the "emtpy" case just yet.