delete tokens after password change

[StringfellowHawke]

Using the email authentication, if I have 2 sessions on different browsers/devices and I reset my password using 1 of the sessions, my other session is still valid. Wouldn't it be prudent to delete all the existing tokens so all my sessions are killed when the password is changed?

[booleanbetrayal]

I think that would break some expected use-cases. I could see token invalidation being a configurable feature though (defaulting to off to retain backwards compatibility). I'll take a look at a PR to that effect.

[booleanbetrayal]

Closed via #474

[StringfellowHawke]

Thanks @paulosoares86

[phfts]

You're welcome, @StringfellowHawke 👍