how can we sign out and invalidate the token generated by graphcool?