Should changing a password invalidate current sessions, or at least the refresh tokens?  Or would a user have to change the password AND log out current sessions to invalidate the current sessions and refresh tokens?  To me it seems like the latter is the current behavior, I just wanted to make sure that it is desirable.