invalidate existing sessions on password change

commafeed-server/src/main/java/com/commafeed/backend/model/User.java

@@ -42,6 +42,9 @@ public class User extends AbstractModel {
     @Column(nullable = false)
     private boolean disabled;
 
+    @Column(nullable = false)
+    private int sessionVersion;
+
     @Column private Instant lastLogin;
 
     @Column private Instant created;

commafeed-server/src/main/java/com/commafeed/backend/service/UserService.java

@@ -155,6 +155,17 @@ public class UserService {
         userDAO.delete(user);
     }
 
+    public void changePassword(User user, String password) {
+        user.setPassword(encryptionService.getEncryptedPassword(password, user.getSalt()));
+        userDAO.merge(user);
+
+        invalidateSessions(user);
+    }
+
+    public void invalidateSessions(User user) {
+        user.setSessionVersion(user.getSessionVersion() + 1);
+    }
+
     public String generateApiKey(User user) {
         byte[] key =
                 encryptionService.getEncryptedPassword(