This should be fixed now.

Invalidation should be possible for any access token, regardless of its properties.