CVE-2012-4413: OpenStack Keystone does not invalidate existing tokens when granting or revoking roles

The vulnerability stemmed from Keystone's failure to revoke tokens during role changes. The patches add token revocation calls to four role management methods in identity/core.py. These functions in their original form (without revocation) would appear in profilers when attackers exploit stale tokens after role changes. The direct modification evidence in all four functions indicates they were the missing security controls.