Signout endpoint #1
Description
Since the user does not neet to be authenticated to call /api/auth/signout you can't get the principal from authentication to find and delete the refreshtoken.
IMHO this method has to get from headers both token and refreshtoken to invalidate/remove the refreshtoken from the database.