title: Django: How to destroy user session after a password reset/change?
body: <p>i've recently implemented a simple change password view in my django project. The thing is that the old session should be destroyed for security reasons. What's the best way of doing this without asking the user to log in again.</p>
  
  <p>I think i could just logout/login him/her, something like this:</p>
  
  <pre><code>from django.contrib.auth import login as auth_login
  from django.contrib.auth import logout as auth_logout
  
  @login_required
  def change_password(request):
    # My stuff
    request.user.set_password(new_password)
    request.user.save()
    # I need this:
    logout(request)
    login(request,request.user)
  </code></pre>
  
  <p>But i think this is not the best idea. What do you think?</p>
  
  <p><strong>Is there another way to do this?</strong></p>
  
  <p><strong>Am I missing something? (I mean, is this secure)</strong></p>