This seems like security/session management 101 I kinda hope/expect any password change will invalidate all client side tokens when I am using an app web based

This seems like security/session management 101 I kinda hope/expect any password change will invalidate all client side tokens when I am using an app web based or otherwise. At the least, invalidate it when I do something that requires a rights check. ( IE adding scammer@someplace.tld as the recovery email or w/e ).