Invalidate Tokens on User Change

[dshanske]

If user's password or email changes, consider invalidating their tokens.

[dshanske]

Specifically, use the after_password_reset hook to invalidate tokens associated with that account, on the theory a password reset means a possible account compromise. This is different than a password change.

The same could be required if the account changed the email address on file.

[dshanske]

Also, on the set_user_role hook, consider revoking tokens.