add `get_user_by_req` and `invalidate_access_token`
We're going to need to use this from places that aren't password auth, so let's move it to a proper class.