I'm developing an ASP.Net application with OWIN and currently I have a problem with claims. I have two levels of application: basic and advanced. Some features are available for advanced users only. So I check claims, and if user doesn't have claim `advanced` I return 403. But here I found the workaround which ruins this system:

* User activates advanced mode
* He performs any action and save its access token
* He disactivates advanced mode
* Now he's able to perform actions just like he is in advanced mode with this token, however he actually has not permissions to do it.

I'm trying to find some fine solution for this situation but I have no ideas except `set 1 minute timeout` or `always check AspNetUserClaims instead of cookie` and so on, but they don't work in my case because he can activate a lifetime feature in this one minute interval and then use it forever.

But i'd like to set some server-side flag like `oops, this guy have just changed his cookies, check it from database` or something to lower database roundtrips for common API calls.

Is there any standard default way to do it? Or maybe I have just chosen a wrong instrument?