[FIX] auth_totp: session update after enabling or disabling totp

bfcc7dee8f tried to fix the session
disconnection issue, but the fix only worked in single-process (either
threaded or workers=1): because the cache was cleared but the update
not flushed, since `_compute_session_token` uses SQL directly it would
recompute the old session_token which it would cache, and thus the
process would carry-on with the old token just re-set in the session
and cache.

Meanwhile in multi-process, odds are good that the next request will
be on a different worker which *will* see the change, and will
immediately complain & destroy the session.

Add the missing flush calls right before recomputing the session token
so the SQL "sees" the correct state.

addons/auth_totp/models/res_users.py

@@ -68,6 +68,7 @@ class Users(models.Model):
 
         self.sudo().totp_secret = secret
         if request:
+            self.flush()
             # update session token so the user does not get logged out (cache cleared by change)
             new_token = self.env.user._compute_session_token(request.session.sid)
             request.session.session_token = new_token
@@ -83,6 +84,7 @@ class Users(models.Model):
 
         self.sudo().write({'totp_secret': False})
         if request and self == self.env.user:
+            self.flush()
             # update session token so the user does not get logged out (cache cleared by change)
             new_token = self.env.user._compute_session_token(request.session.sid)
             request.session.session_token = new_token