2 cases: existing token's session gets removed; unknown token is a no-op (deleteByToken stays idempotent).