Token invalidation does not always log users out

[duart38]

Some front-end virtual middleware needs to be created to ensure that its more clear that a log-out has occurred on the server side of things.