Currently, the auth server doesn't delete session tokens from Redis in its db.deleteDevice method. In order to fix that, the auth server needs to know the session token id for the deleted device. I figured the easiest way to do that would be just to return it from this repo's deleteDevice method. Although perhaps it isn't the "correct" way in API terms, I don't know.

Anyway, here it is. If this approach does seem okay, it would be great if we could include this in train 104, so that train 105 can contain the equivalent auth server changes. No dramas if it doesn't make it though.

@mozilla/fxa-devs r?