But that's just it- only for all tokens. What if a user changes their password? Until that token hits its timing limit, they've got free reign. Or, you use den

But that's just it- only for all tokens. What if a user changes their password? Until that token hits its timing limit, they've got free reign. Or, you use denylists, requiring the database again.