Invalidate auth tokens when a user's permissions are changed.