Would appreciate if anyone could provide HOW-To of clearing user cache,
the problem is that the user can still login after he changes password, even he log out, and session is invalidated.
I think this is because the user cache is not cleared when password is changed. So the result is that the user can login using the old and new password ! (of cause after using the new password, the old one is automatically invalidated).