title: Invalidating Devise user session identifier after password update
body: <p><strong>Scenario:</strong> As an Administrator I need to invalidate a user's session (log them out) after I update the user's password. This is in accordance with best practices as per <a href="https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#Renew_the_Session_ID_After_Any_Privilege_Level_Change" rel="nofollow noreferrer">https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#Renew_the_Session_ID_After_Any_Privilege_Level_Change</a></p>
  <p>I am using Devise and I saw here <a href="https://stackoverflow.com/a/45756884/664675">https://stackoverflow.com/a/45756884/664675</a> there is a config to log the user out: <code>config.sign_in_after_reset_password = false</code></p>
  <p>However, I have enabled this config in my <code>devise.rb</code> but the user remains logged in. Not sure why that is?</p>
  <p>I am also using Redis as the <code>session_store</code></p>
  <pre><code>  Example::Application.config.session_store :cache_store, 
      key: '_example_session', 
      secure: true
  </code></pre>
  <p>Is it feasible to delete the particular user's session store from Redis upon Password reset by the Administrator? And if so how could I find their particular session key within Redis?</p>