Logs in, calls a protected endpoint, revokes the token, then verifies that the same token is rejected.