Invalidate existing sessions when changing email or password

As we don't have any way to actually find the active sessions for
an account we instead store a fingerprint in the session, and refuse
to use any session with a different fingerprint.

app/models/user.rb

@@ -44,6 +44,7 @@
 #
 
 class User < ApplicationRecord
+  require "digest"
   require "xml/libxml"
 
   has_many :traces, -> { where(:visible => true) }
@@ -306,6 +307,13 @@ class User < ApplicationRecord
     ClientApplication.find_by(:key => application_key).access_token_for_user(self)
   end
 
+  def fingerprint
+    digest = Digest::SHA256.new
+    digest.update(email)
+    digest.update(pass_crypt)
+    digest.hexdigest
+  end
+
   private
 
   def set_defaults