Allow users to remotely terminate login sessions

[GoogleCodeExporter]

We should allow users to log themselves out of Plans remotely.

Proposed implementation: modify SessionBroker.php to use the user's password 
hash as part of the string used to sha1-sign cookies. This way, if a user 
changes their password (even to the same thing: crypt() password hashes are 
salted, and two crypt() hashes of the same string are extremely unlikely be 
identical) they will be logged out everywhere. changepassword.php should also 
be modified to bake a new session cookie for the user when they change their 
password, so they aren't forced to log in again.

Original issue reported on code.google.com by [email protected] on 3 Jun 2012 at 4:51

[GoogleCodeExporter]

Sounds good. Go for it.

Original comment by thatha7777 on 4 Jun 2012 at 6:57