Support revocation of access tokens

[zachlipton]

We currently accept any valid JWT token as a database password, which doesn't leave us a way to invalidate an individual token without changing the secret key and invalidating all of them.

To do this we'll need:

• To add a really simple postgres table containing usernames to be denied access. This can probably just be a one-column table (plus an index) that we edit manually given the rarity of needing to revoke access. Define the table in app/models/data.py and create a migration .
• Implement flask_jwt_extended's blocklisting function , @jwt.token_in_blacklist_loader, to check if the token's identity matches a blocklisted username.

By all means shout in my general direction if this is unclear or there are any questions.