[feature] user.invalidateSession fires callback(err,newKey)