Logout returns 200 when given an invalid access_token

[ajberchek]

Description

According to the specification for the /logout endpoint, it invalidates an existing token. However, when supplied an invalid/non-existent access_token (such as "42") it still returns a 200 status code.

Steps to reproduce

• Send a POST to /_matrix/client/r0/logout with an Authorization header containing an invalid access_token (e.g. "Bearer 42")
• Response is a 200 status code

Ideally this should respond with error code M_UNKNOWN_TOKEN to provide a more verbose error

[erikjohnston]

(We probably want to somehow ensure that we return 200 for tokens that were just invalidated by a call to /logout, i.e., we should ensure that we handle the client retrying the request.)

[turt2live]

#2938 claims to have already fixed this issue?

[erikjohnston]

Ah, cool