def get_revocation_key(self, user):
value = '<STR_LIT>'<EOL>if self.invalidate_on_password_change:<EOL><INDENT>value += user.password<EOL><DEDENT>if self.one_time:<EOL><INDENT>value += str(user.last_login)<EOL><DEDENT>return value<EOL>
When the value returned by this method changes, this revocates tokens.

It always includes the password so that changing the password revokes
existing tokens.

In addition, for one-time tokens, it also contains the last login
datetime so that logging in revokes existing tokens.