When an admin resets a password for a user in a system, and sends the user a like to reset the password, do you think it is better to:

1. revoke the old password so the user can’t log in until he changes the password
2. not to revoke the old password so the user can log in until he creates a new password

What is the preferred action when taking into account both security and user experience?