Add configuration to invalidate all sessions when the user signs out.

Closes #2862

This PR adds the `invalidate_all_sessions_on_logout` configuration, that  when enabled will invalidate all the sessions when the user signs out. Without it, the session won't be invalidated.

cc/ @josevalim