Offer the user a choice to invalidate access credentials when changing password

[camallen]

If a user changes their password devise will invalidate the session in the cookie as it relies on the current user password. However our UI's use doorkeeper access tokens after session login, these are valid for 2 hours, a fairly large time window to make account changes.

We should offer the user the choice to invalidate all existing doorkeeper API access tokens when they change / reset their password. Revoking these tokens would mean any logged in session would immediately become invalid. Invalidating these tokens would ensure no other token holders could make account changes within 2 hours.