Re: Uploading large files directly from web application.

You can use the refresh process (that is, calling /oauth2/token with grant_type=refresh_token) to get a new short-lived access token using a refresh token at any time, but doing so does not invalidate previous short-lived access tokens.

You can use /2/auth/token/revoke to revoke an access token, but that will also revoke the corresponding refresh token and other short-lived access tokens for that refresh token, if any.

Dropbox also does not offer a guarantee on the timing as to when during the connection/API call the authorization check occurs, so I would not recommend relying on that.