Your first point is mostly dead on. I see a number of people stating that you cannot revoke a token, and it's simply not true.

The approach I use is to replace the shared session store (which is large, grows linearly with your user base, and hard to sync across clusters if you need that) with a shared revocation list.

The revocation list is small, easy to check, only contains IDs and a TTL, much less cumbersome to replicate... And is functionally equivalent.

If you have already gone the route of using a token for your session, it's really easy to implement and scales much better than a massive in memory store.