web: de-authorized, or invalid tokens triggers 500 internal server error

[jonastar]

They should instead be removed from the db

[jonastar]

on second thought, this might also be related to caching