Http\UserStorage: user invalidation moved to separated method, useful when UserStorage is further extended