public static function passwordChanged(ModelEvent $event)
    {
        $user = $event->getModel();

        if (!$user->_changedPassword) {
            return;
        }

        $app = $user->getApp();
        $auth = $app['auth'];
        $req = $auth->getRequest();
        $ip = $req->ip();
        $userAgent = $req->agent();

        // record the reset password request event
        $event = new AccountSecurityEvent();
        $event->user_id = $user->id();
        $event->type = AccountSecurityEvent::CHANGE_PASSWORD;
        $event->ip = $ip;
        $event->user_agent = $userAgent;
        $event->save();

        // changing the password signs the user out, everywhere
        $auth->signOutAllSessions($user);
        $user->markSignedOut();

        $currentUser = $auth->getCurrentUser();
        if ($currentUser->id() == $user->id()) {
            $auth->logout();
        }

        // send the user an email about it
        $user->sendEmail('password-changed', ['ip' => $ip]);
    }