hook: revoke_active_sessions