Security release: signed-out and revoked sign-in sessions stay revoked,
sign-in sessions expire after 30 days, and a password change ends the
user's other sessions.