and clear session when password is changed.
The sessions are checked using on a fix maximum age of 30 days using the
create_date value. The write_date is updated as long as the delay of the last
update is not bigger than the session timeout.
RPC can request a fresh session. A fresh session is a session that was updated
last time before the session timeout. If it is not the case, the session is
deleted and a request to create a new session is sent to the client.
All the sessions of the users for which the password has been changed are also
deleted in order to ensure that stolen session can no more be used.
We use this new feature for set_preferences of user instead of duplicate the
login mechanism.
issue7568
review53331002
Cédric Krier
5a7aca31ea