alice is logged in on phone, laptop and tablet (3 families); bob on one device.
POST /api/auth/logout with the phone's refresh token: HTTP 204
  phone refresh:  HTTP 401
  laptop refresh: HTTP 200
POST /api/auth/logout with a made-up token:           HTTP 204 (same answer, no oracle)
POST /api/auth/logout-all with the laptop's access token: HTTP 200 {"revoked_tokens":3}
  laptop refresh: HTTP 401
  tablet refresh: HTTP 401
  bob refresh:    HTTP 200 (untouched)
alice's laptop ACCESS token on /api/me after logout-all: HTTP 200
  (it is a signed JWT with 5 minutes left; nothing in the request path asked the store)