Fix unsafe raw-token denylist; recommend jti+aud based revocation (#2242)