Make password changes and resets invalidate existing sessions in my app. Look at the password change and password reset completion handlers and the session storage mechanism. Implement: when a user's password changes (whether via settings or a reset link), every existing session for that account is destroyed server-side except, optionally, the current session performing the change, which should be rotated to a fresh identifier. The user gets an email notification that their password was changed (this doubles as an intrusion alarm: if they didn't do it, they know immediately). If the app supports it, show active sessions in account settings with a "sign out everywhere" option. Do not log the user out of the browser they're actively using to change the password; that's just annoying. Use the session store already in the project; if sessions are stateless JWTs that can't be revoked, tell me and implement a server-side token version or denylist as the smallest workable fix. Give me the changes plus a verification: sign in on two browsers, change the password on one, and confirm the other browser's session is dead while the current one keeps working.