Revoke all permissions from Authenticator.blocked_users

rather than only disabling login, fully block the user from Hub operations
by removing all group membership and role assignments

jupyterhub/orm.py

@@ -1234,6 +1234,8 @@ class APIToken(Hashed, Base):
             orm_token.expires_at = cls.now() + timedelta(seconds=expires_in)
 
         db.commit()
+        if return_orm:
+            return orm_token
         return token
 
     def update_scopes(self, new_scopes):