Design the session store behind a large web product. Logins create sessions, every authenticated page load validates a token, and activity slides a session's expiry forward.
A session token is the key to an account: when a user logs out or has a permission revoked, the very next request already sees the change.