Changing password should invalidate refresh tokens

[AbodeSaafan]

When a user successfully changes a password, the user's refresh tokens should be invalidated (deleting from db). This is an api change, and should also include testing.