Changing the password of user from a particular session should invalidate other sessions

1) Create a user with Read Only Admin privileges.

2) Login a user from two different browsers - browser1 and browser2

3) In session one change the password from browser1

One of the 2 things should happen from browser2

1) Browser 2 session times out

2) All the subsequent calls from browser2 should fail with a error message asking to re-login with a new password.

Currently neither of them happens.