access: forgetting and revoking as the API lets

Two writes the API lets a user make were refused by the rules:

* DELETE /peers/{pk}, with write on _continuum/forgotten alone, writes
  the forget record and removes the member's entry in one change; the
  rules wanted write on the entry. Removing an entry is now also taken
  in a change forgetting that member, from a user who may forget it.
* DELETE /admin/users/{name}/tokens by a user who manages users writes
  _continuum/logouts/<name>; the rules wanted write there. One who may
  write _continuum/users may now write anyone's logouts entry.

Review finding 3 (DELETE /peers, revoking tokens).

1 files changed, 3 insertions, 2 deletions

diff --git a/docs/access.md b/docs/access.md
index d46627a..3bc824b 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -220,12 +220,13 @@ written before the policy (at its dependencies) is judged by none: history from
 stays as it is, wherever it comes from later (a joining node catching up, say).
 
 * A member's entry (`_continuum/members/<id>`) and its votes are written by that member
-  only; removing an entry, also by a user who may write there.
+  only; removing an entry, also by a user who may write there, or who forgets the
+  member in the same change (`DELETE /peers/{pk}`, with `_continuum/forgotten`).
 * Epochs and the swarm ID (`_continuum/epochs`, `_continuum/swarm`) by an epoch's first
   change only (the genesis change, a remake's snapshot).
 * A remake's decision by the coordinator its proposal names; the rest of a record by
   any member.
-* A user's tokens revoked by that user too (logging out).
+* A user's tokens revoked by that user too (logging out), and by one who manages users.
 * A member's forget record cancelled by that member too (forgotten while alive).
 * Everything else, protocol data or not, by a user the registry lets write there.
 * A map made on the way to what a change writes, where there was none (`servers`, for a