It's nice being able to invalidate tokens on demand. However, in the case of a hack/theft, shouldn't changing your password also invalidate all login tokens? Y

It's nice being able to invalidate tokens on demand. However, in the case of a hack/theft, shouldn't changing your password also invalidate all login tokens? You'd be doing that anyways. Right? ;)