Invalidation of tokens

[rubendel]

Created tokens should have a user-specific nonce which is also stored in the User object. When a user changes it's password, or when the user is enabled/disabled, this nonce should be updated (incremented for example, or synced with time), thus invalidating all existing tokens for this user.