Now UserTokens are invalidated if user's password changes