bug(access): invalidate jwts and sessions

[4x4notfound]

We made a change in the JWTs (scopes in jwts are strings) which breaks exisitting jwts (access tokens and refresh tokens). We need to invalidate them if we cannot parse them.