when a signup or password reset token is used invalidate all other tokens for the user fix #44