http://lists.jboss.org/pipermail/security-dev/2013-August/001399.html
We need a JDBC driven TokenRegistry and RevocationRegistry implementations.