This should be fixed now.

Invalidation should be possible for any access token, regardless of it's properties.