Instead of session invalidation being provided: { scope: { id: scopeID } }, it gets: {authenticator: "authenticator:password", org_id: "1"}.