Invalidate sessions on password reset.

This covers the following conditions:

- When a password is reset within a session, all other sessions are logged out
- When a password is reset via password reset request, all sessions are logged out, including any sessions which set passwords in-session.