If the user changes password it invalidates the cache entries automatically, so you avoid stale credentials exploiting the cache At least that's my immediate t

If the user changes password it invalidates the cache entries automatically, so you avoid stale credentials exploiting the cache At least that's my immediate thought, could be wrong.