Invalidate existing user sessions at logon

Currently a user can log into multiple client application sessions across many devices.

This may lead the user to believe that any existing sessions are no longer active as credentials are required each time whilst any previous sessions remain open for the duration of the access token. This is especially true if the user does not complete a system logoff, i.e. would simply close down a web browser.

It would be useful to be able to secure the system further by providing a Realm or Client level configuration option to Invalidate Existing User Sessions at Logon