We need to invalidate on update as well as reauth

Signon will send a reauth message when a user is logged out or
suspended, but a user can also lose permission to our app through their
permisssions being updated.

We should be invalidating on an update otherwise a user can be updated
to not have permissions and carry on using the app. BAD!